nethack-gwaa-kiwi/nethack
1
0
Fork 0
Code Pull Requests Activity

Fix heap-use-after-free

Browse Source 
bcsign was used on a freed obj
This commit is contained in:
Pasi Kallinen
2019-11-11 18:46:14 +02:00
parent bc69fc65d2
commit c2f7fb7d84
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/muse.c
View File

@@ -2497,8 +2497,8 @@ boolean by_you; /* true: if mon kills itself, hero gets credit/blame */
vis = FALSE; /* skip makeknown() below */ vis = FALSE; /* skip makeknown() below */
res = FALSE; /* failed to cure sliming */ res = FALSE; /* failed to cure sliming */
} else { } else {
m_useup(mon, obj); /* before explode() */
dmg = (2 * (rn1(3, 3) + 2 * bcsign(obj)) + 1) / 3; dmg = (2 * (rn1(3, 3) + 2 * bcsign(obj)) + 1) / 3;
m_useup(mon, obj); /* before explode() */
/* -11 => monster's fireball */ /* -11 => monster's fireball */
explode(mon->mx, mon->my, -11, dmg, SCROLL_CLASS, explode(mon->mx, mon->my, -11, dmg, SCROLL_CLASS,
/* by_you: override -11 for mon but not others */ /* by_you: override -11 for mon but not others */