cpp/openttd-patchpack/source Changeset - r16028:f7cfe78e8c66

Changeset - r16028:f7cfe78e8c66

Parent rev.

Child rev.

[Not reviewed]

master

0 2 0

yexo - 14 years ago 2010-09-03 23:04:02
yexo@openttd.org

(svn r20731) -Fix (r20739): SmallVector did not have an assignment operator, causing invalid memory reads / double free

2 files changed with 10 insertions and 2 deletions:

src/core/smallvec_type.hpp

src/landscape.cpp

0 comments (0 inline, 0 general)

src/core/smallvec_type.hpp

➞

Show inline comments

@@ @@ -27,30 +27,38 @@ @@
  * @tparam S The steps of allocation
  */
 template <typename T, uint S>
 class SmallVector {
 protected:
 	T *data;       ///< The pointer to the first item
 	uint items;    ///< The number of items stored
 	uint capacity; ///< The available space for storing items
 public:
 	SmallVector() : data(NULL), items(0), capacity(0) { }
 	template<uint X>
+	template <uint X>
 	SmallVector(const SmallVector<T, X> &other) : data(NULL), items(0), capacity(0)
+	{
 		MemCpyT<T>(this->Append(other.Length()), other.Begin(), other.Length());
+	}
 	template <uint X>
 	SmallVector &operator=(const SmallVector<T, X> &other)
+	{
 		this->Reset();
 		MemCpyT<T>(this->Append(other.Length()), other.Begin(), other.Length());
 		return *this;
+	}
 	~SmallVector()
+	{
 		free(this->data);
+	}
 	/**
 	 * Remove all items from the list.
 	 */
 	FORCEINLINE void Clear()
+	{
 		/* In fact we just reset the item counter avoiding the need to
 		 * probably reallocate the same amount of memory the list was

src/landscape.cpp

➞

Show inline comments

@@ @@ -629,25 +629,25 @@ CommandCost CmdClearArea(TileIndex tile, @@
 	int sx = TileX(p1);
 	int sy = TileY(p1);
 	if (ex < sx) Swap(ex, sx);
 	if (ey < sy) Swap(ey, sy);
 	Money money = GetAvailableMoneyForCommand();
 	CommandCost cost(EXPENSES_CONSTRUCTION);
 	CommandCost last_error = CMD_ERROR;
 	bool had_success = false;
 	for (int x = sx; x <= ex; ++x) {
 		for (int y = sy; y <= ey; ++y) {
-			SmallVector<TileArea, 1> object_areas = _cleared_object_areas;
+			SmallVector<TileArea, 1> object_areas(_cleared_object_areas);
 			CommandCost ret = DoCommand(TileXY(x, y), 0, 0, flags & ~DC_EXEC, CMD_LANDSCAPE_CLEAR);
 			_cleared_object_areas = object_areas;
 			if (ret.Failed()) {
 				last_error = ret;
 				continue;
+			}
 			had_success = true;
 			if (flags & DC_EXEC) {
 				money -= ret.GetCost();
 				if (ret.GetCost() > 0 && money < 0) {
 					_additional_cash_required = ret.GetCost();

0 comments (0 inline, 0 general)