nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

fix #H7659 - accessing freed memory by cutworm()

Browse Source 
hmon() can destroy the weapon being used, and known_hitum() would
still pass the pointer to the freed object to cutworm().  Remember the
relevant weapon attribute before using and maybe freeing the object,
then pass that attribute instead of the whole weapon.  Also pass
'more-likely-to-cut' for axes in addition to blades.

thimonst() behaved similarly, although due to much different code
paths none of the objects that might get to hmon() were then passed to
cutworm(), so it wasn't vulnerable.  But pass 'more-likely-to-cut'
for axes instead of for blades when thrown.
This commit is contained in:
PatR
2018-12-03 18:57:01 -08:00
parent f2195c1212
commit 285023acf6
5 changed files with 25 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/dothrow.c
View File

@@ -1,4 +1,4 @@
/* NetHack 3.6 dothrow.c $NHDT-Date: 1525012611 2018/04/29 14:36:51 $ $NHDT-Branch: master $:$NHDT-Revision: 1.137 $ */
/* NetHack 3.6 dothrow.c $NHDT-Date: 1543892215 2018/12/04 02:56:55 $ $NHDT-Branch: NetHack-3.6.2-beta01 $:$NHDT-Revision: 1.152 $ */
/* Copyright (c) Stichting Mathematisch Centrum, Amsterdam, 1985. */
/*-Copyright (c) Robert Patrick Rankin, 2013. */
/* NetHack may be freely redistributed. See license for details. */
@@ -1652,13 +1652,16 @@ register struct obj *obj; /* thrownobj or kickedobj or uwep */
}
if (tmp >= dieroll) {
boolean wasthrown = (thrownobj != 0);
boolean wasthrown = (thrownobj != 0),
/* remember weapon attribute; hmon() might destroy obj */
chopper = is_axe(obj);
/* attack hits mon */
if (hmode == HMON_APPLIED)
u.uconduct.weaphit++;
if (hmon(mon, obj, hmode, dieroll)) { /* mon still alive */
cutworm(mon, bhitpos.x, bhitpos.y, obj);
if (mon->wormno)
cutworm(mon, bhitpos.x, bhitpos.y, chopper);
}
exercise(A_DEX, TRUE);
/* if hero was swallowed and projectile killed the engulfer,
@@ -1668,8 +1671,9 @@ register struct obj *obj; /* thrownobj or kickedobj or uwep */
if (wasthrown && !thrownobj)
return 1;
/* projectiles other than magic stones
sometimes disappear when thrown */
/* projectiles other than magic stones sometimes disappear
when thrown; projectiles aren't among the types of weapon
that hmon() might have destroyed so obj is intact */
if (objects[otyp].oc_skill < P_NONE
&& objects[otyp].oc_skill > -P_BOOMERANG
&& !objects[otyp].oc_magic) {