dave/openttd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix use after free in train autoreplace chain

Browse Source
This commit is contained in:
Jonathan G Rennison
2019-12-09 03:28:25 +00:00
parent d0564d9298
commit 1029a03291
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/autoreplace_cmd.cpp
View File

@@ -599,10 +599,6 @@ static CommandCost ReplaceChain(Vehicle **chain, DoCommandFlag flags, bool wagon
if ((flags & DC_EXEC) != 0) TransferCargo(w, new_head, true); if ((flags & DC_EXEC) != 0) TransferCargo(w, new_head, true);
/* Sell the vehicle.
* Note: This might temporarily construct new trains, so use DC_AUTOREPLACE to prevent
* it from failing due to engine limits. */
cost.AddCost(DoCommand(0, w->index, 0, flags | DC_AUTOREPLACE, GetCmdSellVeh(w)));
if ((flags & DC_EXEC) != 0) { if ((flags & DC_EXEC) != 0) {
old_vehs[i] = nullptr; old_vehs[i] = nullptr;
if (i == 0) { if (i == 0) {
@@ -610,6 +606,10 @@ static CommandCost ReplaceChain(Vehicle **chain, DoCommandFlag flags, bool wagon
old_head = nullptr; old_head = nullptr;
} }
} }
/* Sell the vehicle.
* Note: This might temporarily construct new trains, so use DC_AUTOREPLACE to prevent
* it from failing due to engine limits. */
cost.AddCost(DoCommand(0, w->index, 0, flags | DC_AUTOREPLACE, GetCmdSellVeh(w)));
} }
if ((flags & DC_EXEC) != 0) CheckCargoCapacity(new_head); if ((flags & DC_EXEC) != 0) CheckCargoCapacity(new_head);