<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Use-after-free in DelayedRenderer::processWrapped - crashes the DAW on dense MIDI (patch included)]]></title><description><![CDATA[<p dir="auto">Hi all,</p>
<p dir="auto">I've been building a multi-mic drum kit, and for days it randomly crashed my DAW whenever I played fast, busy patterns (quick hi-hats, fast toms). It happened in <strong>both Ableton and Reaper,</strong> but never in the HISE standalone, which is what made it so hard to pin down. Windows reported heap corruption (<code>0xC0000374</code>), and the denser the MIDI, the faster it died, sometimes seconds, sometimes 10 minutes.</p>
<p dir="auto">I spent past Sunday debugging it with Claude Code, mostly to read the crash dumps for me.</p>
<p dir="auto">Things we ruled out first, in case it saves anyone time: my scripts (it still crashed with everything disabled), round-robin, choke scripts, voice limits, monoliths vs streamed samples, CPU affinity, deferCallbacks, and the number of samplers. It even crashed with a stripped-down project and an empty script, so it clearly wasn't my code.</p>
<p dir="auto">We eventually ran it under Application Verifier (PageHeap), which turns the delayed heap corruption into an immediate access violation, and symbolicated the dump. <strong>Here's what Claude Code found, pasting its explanation:</strong></p>
<blockquote>
<p dir="auto">The crash is in <code>hi_core/hi_core/MainControllerHelpers.cpp</code>, in <code>DelayedRenderer::processWrapped</code>.</p>
</blockquote>
<blockquote>
<p dir="auto">When the host sends a buffer larger than the prepared block size (the "FL Studio violates the block size" workaround), the function chunks the buffer and calls itself recursively — passing its own member <code>delayedMidiBuffer</code> as the <code>midiMessages</code> argument:</p>
</blockquote>
<pre><code>processWrapped(chunk, delayedMidiBuffer);   // passes the member
</code></pre>
<blockquote>
<p dir="auto">So inside the recursive call, <code>midiMessages</code> is <code>delayedMidiBuffer</code>. Then in the shortBuffer paths:</p>
</blockquote>
<pre><code>MidiBuffer::Iterator it(midiMessages);   // iterator into delayedMidiBuffer
delayedMidiBuffer.clear();               // clears the buffer being iterated
for (auto&amp; e : shortBuffer)
    delayedMidiBuffer.addEvent(...);     // and reallocs it
while (it.getNextEvent(m, pos))          // dangling iterator -&gt; use-after-free
</code></pre>
<blockquote>
<p dir="auto">The <code>clear()</code> and reallocating <code>addEvent()</code> invalidate the iterator, which is then dereferenced. It only appears in a host because the standalone uses a fixed block size, so that recursive path never runs.</p>
</blockquote>
<hr />
<p dir="auto"><strong>The fix</strong> (give the recursion its own buffer so the two can't alias):</p>
<pre><code>// MainControllerHelpers.h — next to delayedMidiBuffer:
MidiBuffer chunkMidiBuffer;

// MainControllerHelpers.cpp — in the oversized-buffer branch:
chunkMidiBuffer.clear();
chunkMidiBuffer.addEvents(midiMessages, thisOffset, numThisTime, -thisOffset);
...
processWrapped(chunk, chunkMidiBuffer);   // was: delayedMidiBuffer
</code></pre>
<p dir="auto">There are two <code>shortBuffer</code> paths that clear/regrow <code>delayedMidiBuffer</code> while iterating <code>midiMessages</code>, so this closes both.</p>
<p dir="auto"><strong>Result:</strong> my full kit used to crash within seconds or minutes. After the patch it ran +25 minutes in Reaper with PageHeap still on (so any remaining bad access would fault immediately) and +25 minutes in Ableton on the exact project that always crashed. No crash.</p>
<p dir="auto"><em><strong>Minor side note it also spotted: <code>alloca(numChannels * sizeof(float*) * numChannels)</code> in the same function allocates <code>numChannels²</code> — harmless, but looks like a typo.</strong></em></p>
<p dir="auto">Hope it's useful information. Thanks for HISE!<br />
Jon</p>
]]></description><link>https://forum.hise.audio/topic/14921/use-after-free-in-delayedrenderer-processwrapped-crashes-the-daw-on-dense-midi-patch-included</link><generator>RSS for Node</generator><lastBuildDate>Wed, 15 Jul 2026 17:44:37 GMT</lastBuildDate><atom:link href="https://forum.hise.audio/topic/14921.rss" rel="self" type="application/rss+xml"/><pubDate>Tue, 14 Jul 2026 12:36:17 GMT</pubDate><ttl>60</ttl></channel></rss>