legacyclonk / LegacyClonk

The LegacyClonk engine and the c4group command line tool.
https://clonkspot.org/lc-en
Other
83 stars 18 forks source link

SetObjectStatus can cause use-after-free in `C4Game::ExecObjects` #121

Closed Fulgen301 closed 6 months ago

Fulgen301 commented 6 months ago

https://github.com/legacyclonk/LegacyClonk/blob/95e7267d4c76abaee85974cccdfdca5e651e457b/src/C4Game.cpp#L1545-L1553

If cObj executes a script that calls SetObjectStatus(C4OS_INACTIVE), C4Object::StatusDeactivate will remove the object from the main object list, freeing cLnk, causing the loop to attempt to read cLnk->Prev from freed memory.

This is what causes the crashes in the Story of Harkon, where an IntScheduleCall effect attached to the story object calls SetObjectStatus on the story object.