fix #H7659 - accessing freed memory by cutworm()

hmon() can destroy the weapon being used, and known_hitum() would
still pass the pointer to the freed object to cutworm().  Remember the
relevant weapon attribute before using and maybe freeing the object,
then pass that attribute instead of the whole weapon.  Also pass
'more-likely-to-cut' for axes in addition to blades.

thimonst() behaved similarly, although due to much different code
paths none of the objects that might get to hmon() were then passed to
cutworm(), so it wasn't vulnerable.  But pass 'more-likely-to-cut'
for axes instead of for blades when thrown.
This commit is contained in:
PatR
2018-12-03 18:57:01 -08:00
parent f2195c1212
commit 285023acf6
5 changed files with 25 additions and 19 deletions

View File

@@ -236,6 +236,8 @@ to emphasize that it's not a light source, change description of wielded Sting
from "(glowing)" to nothing (not warm enough to feel) when blind
glowing Sting quivers if hero becomes blind and quivering Sting glows if
blindness ends; it worked for timed blindness but not for blindfold
weapon (wielded pie, egg, potion, boomerang) might be destroyed when hitting a
long worm, then freed memory was accessed to decide whether to cut it
Fixes to Post-3.6.1 Problems that Were Exposed Via git Repository