diff options
author | Simon Howard | 2015-04-26 18:55:43 -0400 |
---|---|---|
committer | Simon Howard | 2015-04-26 18:55:43 -0400 |
commit | 1bcff874c52aca3134cee636178ab5d6272fef58 (patch) | |
tree | bc43085ef719d5c8fc9633e029e969bc33860abc /src/doom/p_tick.c | |
parent | a915b13e0d0c612c12b8f54132ffa3189375dde5 (diff) | |
download | chocolate-doom-1bcff874c52aca3134cee636178ab5d6272fef58.tar.gz chocolate-doom-1bcff874c52aca3134cee636178ab5d6272fef58.tar.bz2 chocolate-doom-1bcff874c52aca3134cee636178ab5d6272fef58.zip |
Don't read currentthinker->next after Z_Free().
Save the next pointer in the P_RunThinkers() loop when iterating through
thinkers, so that if the current thinker is freed we can still advance
to the next thinker without dereferencing freed memory.
Diffstat (limited to 'src/doom/p_tick.c')
-rw-r--r-- | src/doom/p_tick.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/src/doom/p_tick.c b/src/doom/p_tick.c index 22893500..c933cfe9 100644 --- a/src/doom/p_tick.c +++ b/src/doom/p_tick.c @@ -93,24 +93,26 @@ void P_AllocateThinker (thinker_t* thinker) // void P_RunThinkers (void) { - thinker_t* currentthinker; + thinker_t *currentthinker, *nextthinker; currentthinker = thinkercap.next; while (currentthinker != &thinkercap) { + nextthinker = currentthinker->next; + if ( currentthinker->function.acv == (actionf_v)(-1) ) { // time to remove it currentthinker->next->prev = currentthinker->prev; currentthinker->prev->next = currentthinker->next; - Z_Free (currentthinker); + Z_Free(currentthinker); } else { if (currentthinker->function.acp1) currentthinker->function.acp1 (currentthinker); } - currentthinker = currentthinker->next; + currentthinker = nextthinker; } } |