Skip to content
Snippets Groups Projects

Fix segfault when removing mobjs while iterating thinglist

Merged Hanicef requested to merge Hanicef/SRB2Classic:fix-segfault-remove-thinglist into next
All threads resolved!

If P_RemoveMobj is called on an entry that is currently being iterated through sector.thinglist(), the game segfaults due to it not checking if the value has been deallocated already. This is fixed by simply verifying if the object has been deallocated, and returns an error if it has.

This Lua script can be used to trigger the segfault:

COM_AddCommand("clearmobjs", function (player)
	for sector in sectors.iterate do
		for mobj in sector.thinglist() do
			if not mobj.player then
				P_RemoveMobj(mobj)
			end
		end
	end
end)

Note that you need to compile the game with DEBUGMODE=1 in order to trigger this bug consistently!

Merge request reports

Loading
Loading

Activity

Filter activity
  • Approvals
  • Assignees & reviewers
  • Comments (from bots)
  • Comments (from users)
  • Commits & branches
  • Edits
  • Labels
  • Lock status
  • Mentions
  • Merge request status
  • Tracking
  • Hanicef resolved all threads

    resolved all threads

  • Hanicef added 1 commit

    added 1 commit

    • 21b8acf7 - Change P_MobjWasRemoved to P_RemoveMobj in the error message (thanks Zwip-Zwap Zapony)

    Compare with previous version

  • sphere added Bug label

    added Bug label

  • merged

  • sphere mentioned in commit 0c59a46d

    mentioned in commit 0c59a46d

  • Please register or sign in to reply
    Loading