thirdpartymirrors/RingRacers
1
0
Fork 0
mirror of https://github.com/KartKrewDev/RingRacers.git synced 2025-10-30 08:01:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Attempt to fix use after free bug

Browse source 
with precipitation mobjs on netgame load

# Conflicts:
#	src/p_saveg.c
This commit is contained in:
Ashnal 2022-09-10 13:29:18 -04:00 • committed by toaster
parent ce7fe894b8
commit 16300bee84
2 changed files with 35 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
src/p_mobj.c
View file

@ -10769,20 +10769,34 @@ void P_RemovePrecipMobj(precipmobj_t *mobj)
void P_RemoveSavegameMobj(mobj_t *mobj) void P_RemoveSavegameMobj(mobj_t *mobj)
{ {
// unlink from sector and block lists // unlink from sector and block lists
P_UnsetThingPosition(mobj); if (((thinker_t *)mobj)->function.acp1 == (actionf_p1)P_NullPrecipThinker)
// Remove touching_sectorlist from mobj.
if (sector_list)
{ {
P_DelSeclist(sector_list); P_UnsetPrecipThingPosition((precipmobj_t *)mobj);
sector_list = NULL;
if (precipsector_list)
{
P_DelPrecipSeclist(precipsector_list);
precipsector_list = NULL;
}
}
else
{
// unlink from sector and block lists
P_UnsetThingPosition(mobj);
// Remove touching_sectorlist from mobj.
if (sector_list)
{
P_DelSeclist(sector_list);
sector_list = NULL;
}
} }
// stop any playing sound // stop any playing sound
S_StopSound(mobj); S_StopSound(mobj);
// free block // free block
P_RemoveThinker((thinker_t *)mobj); P_RemoveThinkerDelayed((thinker_t *)mobj); // Call directly here since we are calling P_InitThinkers
R_RemoveMobjInterpolator(mobj); R_RemoveMobjInterpolator(mobj);
} }

15
src/p_saveg.c
View file

@ -3341,6 +3341,19 @@ static thinker_t* LoadMobjThinker(actionf_p1 thinker)
mobj->player->viewz = mobj->player->mo->z + mobj->player->viewheight; mobj->player->viewz = mobj->player->mo->z + mobj->player->viewheight;
} }
if (mobj->type == MT_SKYBOX)
{
mtag_t = mobj->movedir;
if (tag < 0 || tag > 15)
{
CONS_Debug(DBG_GAMELOGIC, "LoadMobjThinker: Skybox ID %d of netloaded object is not between 0 and 15!\n", tag);
}
else if (mobj->flags2 & MF2_AMBUSH)
skyboxcenterpnts[tag] = mobj;
else
skyboxviewpnts[tag] = mobj;
}
if (diff2 & MD2_WAYPOINTCAP) if (diff2 & MD2_WAYPOINTCAP)
P_SetTarget(&waypointcap, mobj); P_SetTarget(&waypointcap, mobj);
@ -3968,7 +3981,7 @@ static void P_NetUnArchiveThinkers(void)
{ {
next = currentthinker->next; next = currentthinker->next;
if (currentthinker->function.acp1 == (actionf_p1)P_MobjThinker) if (currentthinker->function.acp1 == (actionf_p1)P_MobjThinker || currentthinker->function.acp1 == (actionf_p1)P_NullPrecipThinker)
P_RemoveSavegameMobj((mobj_t *)currentthinker); // item isn't saved, don't remove it P_RemoveSavegameMobj((mobj_t *)currentthinker); // item isn't saved, don't remove it
else else
Z_Free(currentthinker); Z_Free(currentthinker);