aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBastien Bouclet2017-08-29 21:34:51 +0200
committerBastien Bouclet2017-09-12 20:25:24 +0200
commit8e235f07a762ea281d0ce366242522b84c518e3b (patch)
tree32cdc29bfcfe7cd622618bbff81d3f3d10250547
parent731028460fe37f534118ba1d30380460f1f9de80 (diff)
downloadscummvm-rg350-8e235f07a762ea281d0ce366242522b84c518e3b.tar.gz
scummvm-rg350-8e235f07a762ea281d0ce366242522b84c518e3b.tar.bz2
scummvm-rg350-8e235f07a762ea281d0ce366242522b84c518e3b.zip
PEGASUS: Disallow loading / saving from the GMM from inner loops
InputDeviceManager::pumpEvents is called from neighborhood classes that are destroyed when loading. Don't allow loading from that method to prevent use after free bugs.
-rw-r--r--engines/pegasus/input.cpp8
-rw-r--r--engines/pegasus/neighborhood/mars/mars.cpp8
2 files changed, 10 insertions, 6 deletions
diff --git a/engines/pegasus/input.cpp b/engines/pegasus/input.cpp
index 47ec44a736..36a84dbd3c 100644
--- a/engines/pegasus/input.cpp
+++ b/engines/pegasus/input.cpp
@@ -223,10 +223,18 @@ bool InputDeviceManager::notifyEvent(const Common::Event &event) {
}
void InputDeviceManager::pumpEvents() {
+ PegasusEngine *vm = ((PegasusEngine *)g_engine);
+
+ bool saveAllowed = vm->swapSaveAllowed(false);
+ bool openAllowed = vm->swapLoadAllowed(false);
+
// Just poll for events. notifyEvent() will pick up on them.
Common::Event event;
while (g_system->getEventManager()->pollEvent(event))
;
+
+ vm->swapSaveAllowed(saveAllowed);
+ vm->swapLoadAllowed(openAllowed);
}
int operator==(const Input &arg1, const Input &arg2) {
diff --git a/engines/pegasus/neighborhood/mars/mars.cpp b/engines/pegasus/neighborhood/mars/mars.cpp
index 432909596e..6e3795d250 100644
--- a/engines/pegasus/neighborhood/mars/mars.cpp
+++ b/engines/pegasus/neighborhood/mars/mars.cpp
@@ -2422,9 +2422,7 @@ void Mars::doCanyonChase() {
_vm->drawScaledFrame(frame, 0, 0);
}
- Common::Event event;
- while (g_system->getEventManager()->pollEvent(event))
- ;
+ InputDevice.pumpEvents();
g_system->delayMillis(10);
}
@@ -3055,9 +3053,7 @@ void Mars::transportToRobotShip() {
_vm->drawScaledFrame(frame, 0, 0);
}
- Common::Event event;
- while (g_system->getEventManager()->pollEvent(event))
- ;
+ InputDevice.pumpEvents();
g_system->delayMillis(10);
}