summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrei Karas <akaras@inbox.ru>2017-05-08 19:34:50 +0300
committerAndrei Karas <akaras@inbox.ru>2017-05-08 19:34:50 +0300
commit652f2cca31626806dc536b4ee3d18aa1d654f569 (patch)
treebd1bcd49ba5b346cb80cf5b554ee71b9d0a36a7d
parent0c1c6b5df196443b18e9e0ef2e9ef3de350a7234 (diff)
downloadmv-652f2cca31626806dc536b4ee3d18aa1d654f569.tar.gz
mv-652f2cca31626806dc536b4ee3d18aa1d654f569.tar.bz2
mv-652f2cca31626806dc536b4ee3d18aa1d654f569.tar.xz
mv-652f2cca31626806dc536b4ee3d18aa1d654f569.zip
Fix crash in cart and fix different use after free in item options.
-rw-r--r--src/net/ea/inventoryitem.h22
-rw-r--r--src/net/eathena/inventoryrecv.cpp4
2 files changed, 25 insertions, 1 deletions
diff --git a/src/net/ea/inventoryitem.h b/src/net/ea/inventoryitem.h
index da0f63283..193500d60 100644
--- a/src/net/ea/inventoryitem.h
+++ b/src/net/ea/inventoryitem.h
@@ -92,11 +92,31 @@ class InventoryItem final
cards[f] = cards0[f];
}
+ InventoryItem(const InventoryItem &c) :
+ slot(c.slot),
+ id(c.id),
+ type(c.type),
+ cards(),
+ options(ItemOptionsList::copy(c.options)),
+ quantity(c.quantity),
+ refine(c.refine),
+ color(c.color),
+ identified(c.identified),
+ damaged(c.damaged),
+ favorite(c.favorite),
+ equip(c.equip)
+ {
+ if (!c.cards)
+ return;
+ for (int f = 0; f < 4; f ++)
+ cards[f] = c.cards[f];
+ }
+
A_DEFAULT_COPY(InventoryItem)
~InventoryItem()
{
- delete [] options;
+ delete options;
}
};
diff --git a/src/net/eathena/inventoryrecv.cpp b/src/net/eathena/inventoryrecv.cpp
index d068b674a..5403e773b 100644
--- a/src/net/eathena/inventoryrecv.cpp
+++ b/src/net/eathena/inventoryrecv.cpp
@@ -727,6 +727,7 @@ void InventoryRecv::processPlayerStorageEquip(Net::MessageIn &msg)
fromBool(flags.bits.isDamaged, Damaged),
fromBool(flags.bits.isFavorite, Favorite),
Equipm_false));
+ delete options;
}
BLOCK_END("InventoryRecv::processPlayerStorageEquip")
}
@@ -787,6 +788,7 @@ void InventoryRecv::processPlayerStorageAdd(Net::MessageIn &msg)
Ea::InventoryRecv::mStorage->setOptions(index, options);
}
}
+ delete options;
BLOCK_END("InventoryRecv::processPlayerStorageAdd")
}
@@ -1009,6 +1011,7 @@ void InventoryRecv::processPlayerCartAdd(Net::MessageIn &msg)
Favorite_false,
Equipm_false));
}
+ delete options;
BLOCK_END("InventoryRecv::processPlayerCartAdd")
}
@@ -1091,6 +1094,7 @@ void InventoryRecv::processPlayerCartEquip(Net::MessageIn &msg)
fromBool(flags.bits.isDamaged, Damaged),
fromBool(flags.bits.isFavorite, Favorite),
Equipm_false));
+ delete options;
}
BLOCK_END("InventoryRecv::processPlayerCartEquip")
}