Skip to content
  • fluzz's avatar
    Fix a 'heap use after free' when resizing a level (issue819). · 4f5b2903
    fluzz authored
    The 'map' member of the level struct is an array of buffers containing
    a row of map_tile structs.
    The map_tile struct contains a list_head member to hold a list of
    volatile obstacles.
    When a list is empty, list_head.next and list_head.prev points
    to the list_head.
    
    When removing the western column of a level, all rows in level->map
    are shifted left by using memmove() and realloc().
    After the memory shift and (possible) memory reallocation, the
    list_head.next and list_head.prev pointers no more point to the right
    memory slot.
    
    The solve the problem, this patch replaces the
    map_tile.volatile_obstacles member by a pointer to a list_head, that
    do not suffer any issue due to memory shifting or reallocation of
    the map_tiles.
    
    This patch also free the memory used by removed rows or columns.
    4f5b2903