PushmePullyu bad85b3c9c SAGA: Fix use-after-free on handling actor action ...

On switching scenes:
Reset _actor->_lastZone in Actor::updateActorsScene().

Actors can store a pointer to a HitZone in _lastZone
(see Actor::handleActions()).

The HitZone pointed to is held by ObjectMap vm->_scene->_objectMap
in array _hitZoneList.

When changing scenes the array elements are cleared via
ObjectMap::clear() and _lastZone can become stale since
only some code paths reset it (e.g. Actor::takeExit()).

The stale pointer is then passed to Actor::stepZoneAction()
from Actor::handleActions() and dereferenced.

Fixes #13661

2023-05-28 23:32:20 +03:00

..

actor_path.cpp

…

actor_walk.cpp

…

actor.cpp

…

actor.h

…

animation.cpp

…

animation.h

…

configure.engine

…

console.cpp

…

console.h

…

credits.pl

…

detection_tables.h

…

detection.cpp

…

detection.h

…

displayinfo.h

…

events.cpp

…

events.h

…

font_map.cpp

…

font.cpp

…

font.h

…

gfx.cpp

…

gfx.h

…

image.cpp

…

input.cpp

…

interface.cpp

…

interface.h

…

introproc_ihnm.cpp

…

introproc_ite.cpp

…

isomap.cpp

…

isomap.h

…

ite8.h

…

itedata.cpp

…

itedata.h

…

metaengine.cpp

…

module.mk

…

music.cpp

…

music.h

…

objectmap.cpp

…

objectmap.h

…

palanim.cpp

…

palanim.h

…

POTFILES

…

puzzle.cpp

…

puzzle.h

…

render.cpp

…

render.h

…

resource_res.cpp

…

resource_rsc.cpp

…

resource.cpp

…

resource.h

…

saga.cpp

…

saga.h

…

saveload.cpp

…

scene.cpp

…

scene.h

…

script.cpp

…

script.h

…

sfuncs_ihnm.cpp

…

sfuncs.cpp

…

shared_detection_defines.h

…

small8.h

…

sndres.cpp

…

sndres.h

…

sound.cpp

…

sound.h

…

sprite.cpp

…

sprite.h

…

sthread.cpp

…

xref.txt

…