From 2dda1c43b2691c362c1c8e9f73ce1336e14b703b Mon Sep 17 00:00:00 2001 From: Pasi Kallinen Date: Sun, 29 Dec 2019 17:28:15 +0200 Subject: [PATCH] Fix heap-use-after-free when rewielding partial stack --- src/wield.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/wield.c b/src/wield.c index 44277e829..6d0f5a7aa 100644 --- a/src/wield.c +++ b/src/wield.c @@ -295,6 +295,8 @@ dowield() any other item, we need to give it its own inventory slot */ if (uwep && uwep->o_id == g.context.objsplit.parent_oid) { unsplitobj(wep); + /* wep was merged back to uwep, already_wielded uses wep */ + wep = uwep; goto already_wielded; } finish_splitting = TRUE;