From 54d715fc445ac72bf000c75a694e5ba24d6de98a Mon Sep 17 00:00:00 2001
From: Dragon-Git <1762578117@qq.com>
Date: Fri, 3 Jul 2026 09:18:05 +0800
Subject: [PATCH] Fix heap-use-after-free in VlRNG::VlRNG() due to dangling
 thread-local t_currentp

When a function (e.g. eval_static) creates a VlProcess via make_shared
and sets VlProcess::currentp(vlProcess.get()), the thread-local
t_currentp pointer is left dangling after the shared_ptr destroys the
VlProcess object at function exit. A subsequent function (e.g.
eval_initial) that constructs a new VlProcess triggers VlRNG::VlRNG(),
which calls VlProcess::currentRng() and reads the freed t_currentp,
causing a heap-use-after-free.

Fix by clearing t_currentp in ~VlProcess() when it points to the
dying object, redirecting to the parent process if one exists.
---
 docs/CONTRIBUTORS         | 3 ++-
 include/verilated_types.h | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/CONTRIBUTORS b/docs/CONTRIBUTORS
index 763ac8ac0..3170421fa 100644
--- a/docs/CONTRIBUTORS
+++ b/docs/CONTRIBUTORS
@@ -61,6 +61,7 @@ David Turner
 Dercury
 Diego Roux
 Dominick Grochowina
+Dragon-Git
 Don Williamson
 Drew Ranck
 Drew Taussig
@@ -334,4 +335,4 @@ Yogish Sekhar
 Zubin Jain
 Muzaffer Kal
 Yilin Li
-Shashvat Prabhu
+Shashvat Prabhu
\ No newline at end of file
diff --git a/include/verilated_types.h b/include/verilated_types.h
index 40847b65e..6733dda89 100644
--- a/include/verilated_types.h
+++ b/include/verilated_types.h
@@ -337,6 +337,7 @@ public:
 
     ~VlProcess() {
         if (m_parentp) m_parentp->detach(this);
+        if (t_currentp == this) t_currentp = m_parentp;
     }
 
     void attach(VlProcess* childp) { m_children.insert(childp); }