From b781fc29a703bb36a2e485f8b671a5afb3d96f32 Mon Sep 17 00:00:00 2001 From: Tomasz Wlostowski Date: Mon, 16 Mar 2026 21:37:57 +0100 Subject: [PATCH] router: fix use-after-free error when dragging a single (no tracks attached via) in shove mode Fixes: https://gitlab.com/kicad/code/kicad/-/work_items/23449 (cherry picked from commit 1909f3a8b32ca708918ef9b69b234d05d4027e99) --- pcbnew/router/pns_shove.cpp | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) diff --git a/pcbnew/router/pns_shove.cpp b/pcbnew/router/pns_shove.cpp index 8d62efa9a0..150d1c7212 100644 --- a/pcbnew/router/pns_shove.cpp +++ b/pcbnew/router/pns_shove.cpp @@ -2443,29 +2443,13 @@ SHOVE::SHOVE_STATUS SHOVE::Run() m_currentNode = parent->Branch(); m_currentNode->ClearRanks(); - - - - - //nodeStats( Dbg(), m_currentNode, "right-after-branch" ); auto iface = Router()->GetInterface(); - // for ( auto& hq : m_headLines ) - // if( hq.oldHead ) - // m_currentNode->Remove( *hq.oldHead ); - - // Push the via to its new location for( auto& headLineEntry : m_headLines ) { - //if( rootEntry->line ) // head already processed in previous steps - //{ - // PNS_DBG( Dbg(), Message, wxString::Format( "RL found" ) ); - - //continue; - //} m_currentNode->ClearRanks(); if( headLineEntry.theVia ) @@ -2619,6 +2603,11 @@ SHOVE::SHOVE_STATUS SHOVE::Run() } } + // NODE's destructor invalidates all linked items in the LINEs stored in the stack/queue + // Erase them first to avoid a use-after-free issue. + m_lineStack.clear(); + m_optimizerQueue.clear(); + pruneRootLines( m_currentNode ); delete m_currentNode;