summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorskotlex <skotlex@54d463be-8e91-2dee-dedb-b68131a5f0ec>2008-01-13 23:06:06 +0000
committerskotlex <skotlex@54d463be-8e91-2dee-dedb-b68131a5f0ec>2008-01-13 23:06:06 +0000
commitb9de9046df71b8e8c0e44a1f8eba931262f7f8e7 (patch)
tree63cf7ec0f7a48f03b340fab3657ea4c2bb3dd8c2 /src
parent057e290874b150055207082b16fd6fe733049391 (diff)
downloadhercules-b9de9046df71b8e8c0e44a1f8eba931262f7f8e7.tar.gz
hercules-b9de9046df71b8e8c0e44a1f8eba931262f7f8e7.tar.bz2
hercules-b9de9046df71b8e8c0e44a1f8eba931262f7f8e7.tar.xz
hercules-b9de9046df71b8e8c0e44a1f8eba931262f7f8e7.zip
- Fixed dangling pointer crashes when bleeding or Deadly poison kills a spawn-once monster.
- Fixed a possible ERS entry corruption when Deadly Poison kills a target that has kaziel active. git-svn-id: https://rathena.svn.sourceforge.net/svnroot/rathena/trunk@12069 54d463be-8e91-2dee-dedb-b68131a5f0ec
Diffstat (limited to 'src')
-rw-r--r--src/map/status.c16
1 files changed, 11 insertions, 5 deletions
diff --git a/src/map/status.c b/src/map/status.c
index b62756c53..56d68bbfe 100644
--- a/src/map/status.c
+++ b/src/map/status.c
@@ -6788,9 +6788,12 @@ int status_change_timer(int tid, unsigned int tick, int id, int data)
case SC_DPOISON:
if (--(sce->val3) > 0) {
if (!sc->data[SC_SLOWPOISON]) {
+ bool flag;
+ map_freeblock_lock();
status_zap(bl, sce->val4, 0);
- if (status_isdead(bl))
- break;
+ flag = sc->data[type]; //We check for this rather than 'killed' since the target could have revived with kaizel.
+ map_freeblock_unlock();
+ if (!flag) return 0; //target died, SC cancelled already.
}
sc_timer_next(1000 + tick, status_change_timer, bl->id, data );
return 0;
@@ -6806,10 +6809,13 @@ int status_change_timer(int tid, unsigned int tick, int id, int data)
case SC_BLEEDING:
if (--(sce->val4) >= 0) {
+ int flag;
+ map_freeblock_lock();
status_fix_damage(NULL, bl, rand()%600 + 200, 0);
- if (status_isdead(bl) || !sc->data[type]) //It is possible you revived from kaizel if killed.
- break;
- sc_timer_next(10000 + tick, status_change_timer, bl->id, data );
+ flag = sc->data[type];
+ map_freeblock_unlock();
+ if (!flag) return 0; //SC already ended.
+ sc_timer_next(10000 + tick, status_change_timer, bl->id, data);
return 0;
}
break;