From 8218ce0fe290f7047999328304ea69cfb4c39934 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gustaf=20Alh=C3=A4ll?= Date: Fri, 7 Apr 2023 14:49:31 +0200 Subject: [PATCH] Fix use-after-free when Metal Sonic charges energy balls --- src/p_mobj.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/src/p_mobj.c b/src/p_mobj.c index c8adb6f1d..4281d6e76 100644 --- a/src/p_mobj.c +++ b/src/p_mobj.c @@ -5665,21 +5665,25 @@ static void P_Boss9Thinker(mobj_t *mobj) missile->fuse = 1; if (missile->fuse > mobj->fuse) - P_RemoveMobj(missile); - - if (mobj->health > mobj->info->damage) { - P_SetScale(missile, FRACUNIT/3); - missile->color = SKINCOLOR_MAGENTA; // sonic OVA/4 purple power + P_RemoveMobj(missile); } else { - P_SetScale(missile, FRACUNIT/5); - missile->color = SKINCOLOR_SUNSET; // sonic cd electric power + if (mobj->health > mobj->info->damage) + { + P_SetScale(missile, FRACUNIT/3); + missile->color = SKINCOLOR_MAGENTA; // sonic OVA/4 purple power + } + else + { + P_SetScale(missile, FRACUNIT/5); + missile->color = SKINCOLOR_SUNSET; // sonic cd electric power + } + missile->destscale = missile->scale*2; + missile->scalespeed = abs(missile->scale - missile->destscale)/missile->fuse; + missile->colorized = true; } - missile->destscale = missile->scale*2; - missile->scalespeed = abs(missile->scale - missile->destscale)/missile->fuse; - missile->colorized = true; } // ...then down. easier than changing the missile's momz after-the-fact