nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

Fix heap use after free

Browse Source 
In a lua script, if object was created inside a container, it
might've merged with another object.

Also prevent stacking, lighting, and burying contained objects.
This commit is contained in:
Pasi Kallinen
2020-04-18 22:13:49 +03:00
parent 9b74ea0b22
commit 9784b5adef
1 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/sp_lev.c
View File

@@ -2239,7 +2239,7 @@ struct mkroom *croom;
remove_object(otmp); remove_object(otmp);
if (cobj) { if (cobj) {
(void) add_to_container(cobj, otmp); otmp = add_to_container(cobj, otmp);
cobj->owt = weight(cobj); cobj->owt = weight(cobj);
} else { } else {
obj_extract_self(otmp); obj_extract_self(otmp);
@@ -2324,18 +2324,19 @@ struct mkroom *croom;
} }
} }
stackobj(otmp); if (!(o->containment & SP_OBJ_CONTENT)) {
stackobj(otmp);
if (o->lit) { if (o->lit)
begin_burn(otmp, FALSE); begin_burn(otmp, FALSE);
}
if (o->buried) { if (o->buried) {
boolean dealloced; boolean dealloced;
(void) bury_an_obj(otmp, &dealloced); (void) bury_an_obj(otmp, &dealloced);
if (dealloced && container_idx) { if (dealloced && container_idx) {
container_obj[container_idx - 1] = NULL; container_obj[container_idx - 1] = NULL;
}
} }
} }
} }