mirror of
https://github.com/ALLFATHER-BV/wadamesh.git
synced 2026-09-25 06:56:13 +00:00
Kaj SchittecatandClaude Opus 5
2f6984443d
Pressing down past the last message page-scrolls the chat list with an LVGL animation. In a long chat the list uses compressed scroll coordinates, and chatVirtRemap1To1Scroll re-anchored the position on every LV_EVENT_SCROLL with lv_obj_scroll_to_y(LV_ANIM_OFF). That deletes the running animation from inside its own step. LVGL 8.4 reads the animation again after the step, and when the step was also its last (the UI loop was busy for longer than the animation) it finished the freed animation and freed it a second time. By the next round that memory belonged to something else, and anim_timer called a garbage get_value_cb: the jump to 0x00020000 in the beta_79 and beta_80 M9 dumps, both at the same call site. - chatVirtRemap1To1Scroll follows a scroll that an animation drives and leaves the re-anchor to chatVirtOnScrollEnd. The page scroll now also completes on long chats; the early re-anchor stopped it after a frame. - scripts/build/patch_lvgl_anim_uaf.py skips LVGL's completion check when the animation list changed during the step, as LVGL 9 does. Applied to every touch env as a pre-script and to the vendored P4 copy (fetch-deps.sh, build.sh). Idempotent, fails closed on source drift. - test/lvgl_anim_uaf/run.sh reproduces it on the host under AddressSanitizer: stock LVGL with the old handler reports the use-after-free in anim_timer, and either fix alone runs clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>