dave/openttd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix crash when opening object picker window.

Browse Source 
SELGW = ScenarioEditorLandscapeGenerationWindow
Crash is triggered by the following:
1. SELGW has a OnPlaceObject active (e.g. raise/lower land).
2. SELGW button is clicked to open BuildObjectWindow
3. BuildObjectWindow constructor calls ResetObjectToPlace
4: SELGW::OnPlaceObjectAbort is called
5: DeleteWindowById(WC_BUILD_OBJECT, 0) is called
6: BuildObjectWindow is freed whilst its constructor is executing
7: Crash occurs either through access to this->vscroll
   or during the dynamic_cast to get widget: WID_BO_SELECT_MATRIX.

The use-after-free was caught by AddressSanitizer.
This commit is contained in:
Jonathan G Rennison
2015-09-09 19:24:13 +01:00
parent 46df5f8343
commit af85ccbbc3
1 changed files with 0 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/terraform_gui.cpp
View File

@@ -739,9 +739,6 @@ struct ScenarioEditorLandscapeGenerationWindow : Window {
{ {
this->RaiseButtons(); this->RaiseButtons();
this->SetDirty(); this->SetDirty();
DeleteWindowById(WC_BUILD_OBJECT, 0);
DeleteWindowById(WC_BUILD_HOUSE, 0);
DeleteWindowById(WC_SELECT_STATION, 0);
} }
static HotkeyList hotkeys; static HotkeyList hotkeys;