thirdpartymirrors/RingRacers
1
0
Fork 0
mirror of https://github.com/KartKrewDev/RingRacers.git synced 2025-10-30 08:01:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Attempt to fix use after free bug

Browse source 
with precipitation mobjs on netgame load

# Conflicts:
#	src/p_saveg.c
This commit is contained in:
Ashnal 2022-09-10 13:29:18 -04:00 • committed by toaster
parent ce7fe894b8
commit 16300bee84
2 changed files with 35 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/p_mobj.c
View file

@ -10767,6 +10767,19 @@ void P_RemovePrecipMobj(precipmobj_t *mobj)
// Clearing out stuff for savegames
void P_RemoveSavegameMobj(mobj_t *mobj)
{
// unlink from sector and block lists
if (((thinker_t *)mobj)->function.acp1 == (actionf_p1)P_NullPrecipThinker)
{
P_UnsetPrecipThingPosition((precipmobj_t *)mobj);
if (precipsector_list)
{
P_DelPrecipSeclist(precipsector_list);
precipsector_list = NULL;
}
}
else
{
// unlink from sector and block lists
P_UnsetThingPosition(mobj);
@ -10777,12 +10790,13 @@ void P_RemoveSavegameMobj(mobj_t *mobj)
P_DelSeclist(sector_list);
sector_list = NULL;
}
}
// stop any playing sound
S_StopSound(mobj);
// free block
P_RemoveThinker((thinker_t *)mobj);
P_RemoveThinkerDelayed((thinker_t *)mobj); // Call directly here since we are calling P_InitThinkers
R_RemoveMobjInterpolator(mobj);
}

15
src/p_saveg.c
View file

@ -3341,6 +3341,19 @@ static thinker_t* LoadMobjThinker(actionf_p1 thinker)
mobj->player->viewz = mobj->player->mo->z + mobj->player->viewheight;
}
if (mobj->type == MT_SKYBOX)
{
mtag_t = mobj->movedir;
if (tag < 0 || tag > 15)
{
CONS_Debug(DBG_GAMELOGIC, "LoadMobjThinker: Skybox ID %d of netloaded object is not between 0 and 15!\n", tag);
}
else if (mobj->flags2 & MF2_AMBUSH)
skyboxcenterpnts[tag] = mobj;
else
skyboxviewpnts[tag] = mobj;
}
if (diff2 & MD2_WAYPOINTCAP)
P_SetTarget(&waypointcap, mobj);
@ -3968,7 +3981,7 @@ static void P_NetUnArchiveThinkers(void)
{
next = currentthinker->next;
if (currentthinker->function.acp1 == (actionf_p1)P_MobjThinker)
if (currentthinker->function.acp1 == (actionf_p1)P_MobjThinker || currentthinker->function.acp1 == (actionf_p1)P_NullPrecipThinker)
P_RemoveSavegameMobj((mobj_t *)currentthinker); // item isn't saved, don't remove it
else
Z_Free(currentthinker);