Merge branch 'netunarchive-fixes' into 'master'

Fix use after free bug

See merge request KartKrew/Kart-Public!315
This commit is contained in:
Sal 2022-10-19 06:19:28 +00:00
commit a69b3b0260
3 changed files with 43 additions and 11 deletions

View file

@ -10297,6 +10297,19 @@ void P_RemovePrecipMobj(precipmobj_t *mobj)
// Clearing out stuff for savegames // Clearing out stuff for savegames
void P_RemoveSavegameMobj(mobj_t *mobj) void P_RemoveSavegameMobj(mobj_t *mobj)
{ {
// unlink from sector and block lists
if (((thinker_t *)mobj)->function.acp1 == (actionf_p1)P_NullPrecipThinker)
{
P_UnsetPrecipThingPosition((precipmobj_t *)mobj);
if (precipsector_list)
{
P_DelPrecipSeclist(precipsector_list);
precipsector_list = NULL;
}
}
else
{
// unlink from sector and block lists // unlink from sector and block lists
P_UnsetThingPosition(mobj); P_UnsetThingPosition(mobj);
@ -10306,13 +10319,20 @@ void P_RemoveSavegameMobj(mobj_t *mobj)
P_DelSeclist(sector_list); P_DelSeclist(sector_list);
sector_list = NULL; sector_list = NULL;
} }
}
// stop any playing sound // stop any playing sound
S_StopSound(mobj); S_StopSound(mobj);
R_RemoveMobjInterpolator(mobj);
// free block // free block
P_RemoveThinker((thinker_t *)mobj); // Here we use the same code as R_RemoveThinkerDelayed, but without reference counting (we're removing everything so it shouldn't matter) and without touching currentthinker since we aren't in P_RunThinkers
R_RemoveMobjInterpolator(mobj); {
thinker_t *thinker = (thinker_t *)mobj;
thinker_t *next = thinker->next;
(next->prev = thinker->prev)->next = next;
Z_Free(thinker);
}
} }
static CV_PossibleValue_t respawnitemtime_cons_t[] = {{1, "MIN"}, {300, "MAX"}, {0, NULL}}; static CV_PossibleValue_t respawnitemtime_cons_t[] = {{1, "MIN"}, {300, "MAX"}, {0, NULL}};

View file

@ -2166,6 +2166,14 @@ static void LoadMobjThinker(actionf_p1 thinker)
mobj->player->viewz = mobj->player->mo->z + mobj->player->viewheight; mobj->player->viewz = mobj->player->mo->z + mobj->player->viewheight;
} }
if (mobj->type == MT_SKYBOX)
{
if (mobj->spawnpoint->options & MTF_OBJECTSPECIAL)
skyboxmo[1] = mobj;
else
skyboxmo[0] = mobj;
}
P_AddThinker(&mobj->thinker); P_AddThinker(&mobj->thinker);
if (diff2 & MD2_WAYPOINTCAP) if (diff2 & MD2_WAYPOINTCAP)
@ -2666,11 +2674,15 @@ static void P_NetUnArchiveThinkers(void)
{ {
next = currentthinker->next; next = currentthinker->next;
if (currentthinker->function.acp1 == (actionf_p1)P_MobjThinker) if (currentthinker->function.acp1 == (actionf_p1)P_MobjThinker || currentthinker->function.acp1 == (actionf_p1)P_NullPrecipThinker)
P_RemoveSavegameMobj((mobj_t *)currentthinker); // item isn't saved, don't remove it P_RemoveSavegameMobj((mobj_t *)currentthinker); // item isn't saved, don't remove it
else else
{
(next->prev = currentthinker->prev)->next = next;
R_DestroyLevelInterpolators(currentthinker);
Z_Free(currentthinker); Z_Free(currentthinker);
} }
}
// we don't want the removed mobjs to come back // we don't want the removed mobjs to come back
iquetail = iquehead = 0; iquetail = iquehead = 0;

View file

@ -3124,14 +3124,14 @@ boolean P_SetupLevel(boolean skipprecip)
if (!playerstarts[numcoopstarts]) if (!playerstarts[numcoopstarts])
break; break;
globalweather = mapheaderinfo[gamemap-1]->weather;
// set up world state // set up world state
P_SpawnSpecials(fromnetsave); P_SpawnSpecials(fromnetsave);
if (loadprecip) // ugly hack for P_NetUnArchiveMisc (and P_LoadNetGame) if (loadprecip) // ugly hack for P_NetUnArchiveMisc (and P_LoadNetGame)
P_SpawnPrecipitation(); P_SpawnPrecipitation();
globalweather = mapheaderinfo[gamemap-1]->weather;
#ifdef HWRENDER // not win32 only 19990829 by Kin #ifdef HWRENDER // not win32 only 19990829 by Kin
if (rendermode != render_soft && rendermode != render_none) if (rendermode != render_soft && rendermode != render_none)
{ {