Fixed bug with BoundingBox Lua constructor

Fixed use-after-free in DestroyLight
This commit is contained in:
ghassanpl 2016-08-06 22:14:49 +02:00
parent 6f27941e28
commit 47b6e62744
2 changed files with 5 additions and 4 deletions

View file

@ -2559,11 +2559,13 @@ void DestroyLight(Light light)
{ {
if (light != NULL) if (light != NULL)
{ {
int light_id = light->id;
// Free dynamic memory allocation // Free dynamic memory allocation
free(lights[light->id]); free(lights[light_id]);
// Remove *obj from the pointers array // Remove *obj from the pointers array
for (int i = light->id; i < lightsCount; i++) for (int i = light_id; i < lightsCount; i++)
{ {
// Resort all the following pointers of the array // Resort all the following pointers of the array
if ((i + 1) < lightsCount) if ((i + 1) < lightsCount)
@ -2571,7 +2573,6 @@ void DestroyLight(Light light)
lights[i] = lights[i + 1]; lights[i] = lights[i + 1];
lights[i]->id = lights[i + 1]->id; lights[i]->id = lights[i + 1]->id;
} }
else free(lights[i]);
} }
// Decrease enabled physic objects count // Decrease enabled physic objects count

View file

@ -768,7 +768,7 @@ static int lua_BoundingBox(lua_State* L)
{ {
Vector3 min = LuaGetArgument_Vector3(L, 1); Vector3 min = LuaGetArgument_Vector3(L, 1);
Vector3 max = LuaGetArgument_Vector3(L, 2); Vector3 max = LuaGetArgument_Vector3(L, 2);
LuaPush_BoundingBox(L, (BoundingBox) { { min.x, min.y }, { max.x, max.y } }); LuaPush_BoundingBox(L, (BoundingBox) { { min.x, min.y, min.z }, { max.x, max.y, max.z } });
return 1; return 1;
} }