nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

fix #H7659 - accessing freed memory by cutworm()

Browse Source 
hmon() can destroy the weapon being used, and known_hitum() would
still pass the pointer to the freed object to cutworm().  Remember the
relevant weapon attribute before using and maybe freeing the object,
then pass that attribute instead of the whole weapon.  Also pass
'more-likely-to-cut' for axes in addition to blades.

thimonst() behaved similarly, although due to much different code
paths none of the objects that might get to hmon() were then passed to
cutworm(), so it wasn't vulnerable.  But pass 'more-likely-to-cut'
for axes instead of for blades when thrown.
This commit is contained in:
PatR
2018-12-03 18:57:01 -08:00
parent f2195c1212
commit 285023acf6
5 changed files with 25 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
include/extern.h
View File

@@ -1,4 +1,4 @@
/* NetHack 3.6 extern.h $NHDT-Date: 1543745352 2018/12/02 10:09:12 $ $NHDT-Branch: NetHack-3.6.2-beta01 $:$NHDT-Revision: 1.664 $ */
/* NetHack 3.6 extern.h $NHDT-Date: 1543892214 2018/12/04 02:56:54 $ $NHDT-Branch: NetHack-3.6.2-beta01 $:$NHDT-Revision: 1.665 $ */
/* Copyright (c) Steve Creps, 1988. */
/* NetHack may be freely redistributed. See license for details. */
@@ -2834,7 +2834,7 @@ E void FDECL(worm_move, (struct monst *));
E void FDECL(worm_nomove, (struct monst *));
E void FDECL(wormgone, (struct monst *));
E void FDECL(wormhitu, (struct monst *));
E void FDECL(cutworm, (struct monst *, XCHAR_P, XCHAR_P, struct obj *));
E void FDECL(cutworm, (struct monst *, XCHAR_P, XCHAR_P, BOOLEAN_P));
E void FDECL(see_wsegs, (struct monst *));
E void FDECL(detect_wsegs, (struct monst *, BOOLEAN_P));
E void FDECL(save_worm, (int, int));