diff --git a/source/blender/windowmanager/intern/wm_files.c b/source/blender/windowmanager/intern/wm_files.c index f6abb5964588f3f186388c4b4f58007c2579592b..887151e74fc712495ee44f8669b93757d7af5dd8 100644 --- a/source/blender/windowmanager/intern/wm_files.c +++ b/source/blender/windowmanager/intern/wm_files.c @@ -3602,11 +3602,15 @@ static void save_file_forwardcompat_cancel_button(uiBlock *block, wmGenericCallb static void save_file_forwardcompat_overwrite(bContext *C, void *arg_block, void *arg_data) { wmWindow *win = CTX_wm_window(C); - UI_popup_block_close(C, win, arg_block); /* Re-use operator properties as defined for the initial 'save' operator, which triggered this * 'forward compat' popup. */ wmGenericCallback *callback = WM_generic_callback_steal(arg_data); + + /* Needs to be done after stealing the callback data above, otherwise it would cause a + * use-after-free. */ + UI_popup_block_close(C, win, arg_block); + PointerRNA operator_propptr = {0}; PointerRNA *operator_propptr_p = &operator_propptr; IDProperty *operator_idproperties = callback->user_data;