fix github issue #731 - accessing freed memory \
after charging causes a ring to explode Reported by gebulmer: if charging exploded a ring, the ring's memory got freed but the stale pointer was passed to cap_spe() which accessed it again. Fix by setting the object pointer to Null after using up the ring. This was a post-3.6 bug. Fixes #731
This commit is contained in:
@@ -786,7 +786,7 @@ recharge(struct obj* obj, int curse_bless)
|
||||
if (is_on)
|
||||
Ring_gone(obj);
|
||||
s = rnd(3 * abs(obj->spe)); /* amount of damage */
|
||||
useup(obj);
|
||||
useup(obj), obj = 0;
|
||||
losehp(Maybe_Half_Phys(s), "exploding ring", KILLED_BY_AN);
|
||||
} else {
|
||||
long mask = is_on ? (obj == uleft ? LEFT_RING : RIGHT_RING) : 0L;
|
||||
|
||||
Reference in New Issue
Block a user