[BUG]Bug in stock do_quit

From: Peter Ajamian (peter@pajamian.dhs.org)
Date: 01/01/01


I checked this out in stock bpl17 to make sure it wasn't something that
cropped up in a patch or snippet I added...

in act.other.c at the end of the funtion do_quit...

    extract_char(ch);           /* Char is saved in extract char */

    /* If someone is quitting in their house, let them load back here */
    if (ROOM_FLAGGED(loadroom, ROOM_HOUSE))
      save_char(ch, loadroom);


Here's the problem...

extract_char calls free_char(ch) which in turn calls free(ch).

after ch has been freed you are referencing it (an invalid area of
memory) in save_char.

I wish I could come up with a solution which would accomplish the same
thing, but I am at a relative loss right now, but at least the bug is
identified..  Could be pretty serious, possible seg fault.

Regards, Peter

--
   +---------------------------------------------------------------+
   | FAQ: http://qsilver.queensu.ca/~fletchra/Circle/list-faq.html |
   | Archives: http://post.queensu.ca/listserv/wwwarch/circle.html |
   +---------------------------------------------------------------+



This archive was generated by hypermail 2b30 : 12/03/01 PST