fix #H7659 - accessing freed memory by cutworm()
hmon() can destroy the weapon being used, and known_hitum() would still pass the pointer to the freed object to cutworm(). Remember the relevant weapon attribute before using and maybe freeing the object, then pass that attribute instead of the whole weapon. Also pass 'more-likely-to-cut' for axes in addition to blades. thimonst() behaved similarly, although due to much different code paths none of the objects that might get to hmon() were then passed to cutworm(), so it wasn't vulnerable. But pass 'more-likely-to-cut' for axes instead of for blades when thrown.
This commit is contained in:
@@ -236,6 +236,8 @@ to emphasize that it's not a light source, change description of wielded Sting
|
||||
from "(glowing)" to nothing (not warm enough to feel) when blind
|
||||
glowing Sting quivers if hero becomes blind and quivering Sting glows if
|
||||
blindness ends; it worked for timed blindness but not for blindfold
|
||||
weapon (wielded pie, egg, potion, boomerang) might be destroyed when hitting a
|
||||
long worm, then freed memory was accessed to decide whether to cut it
|
||||
|
||||
|
||||
Fixes to Post-3.6.1 Problems that Were Exposed Via git Repository
|
||||
|
||||
Reference in New Issue
Block a user