Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix use-after-free in creature conditions #4726

Merged
merged 1 commit into from
Jun 4, 2024

Conversation

diath
Copy link
Contributor

@diath diath commented Jun 3, 2024

The Creature class destructor loops over the conditions member variable and calls condition->endCondition then deletes the condition object, however, ConditionInvisible::endCondition calls Creature::isInvisible, which subsequently loops over the conditions (which are not erased when being deleted in the destructor), calling condition->getType on an already deleted memory, resulting in UAF. This fixes the issue by first ending all conditions, then deleting them separately (as erasing the elements one-by-one in the Creature destructor does not make much sense).

@EvilHero90 EvilHero90 added enhancement Increase or improvement in quality, value, or extent bugfix labels Jun 3, 2024
@EvilHero90 EvilHero90 added this to the 1.6 milestone Jun 3, 2024
Copy link
Member

@ranisalt ranisalt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch. It is probably better to use smart pointers here, but this is a good stop-gap.

@EvilHero90 EvilHero90 merged commit 3d7c2fe into otland:master Jun 4, 2024
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bugfix enhancement Increase or improvement in quality, value, or extent
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

None yet

4 participants