From e50f8cfaa090b83403b1f9b545932e8066613611 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20M=C3=BCller?= Date: Wed, 21 Feb 2024 23:26:01 +0100 Subject: [PATCH] Fix client crash if `cl_race_ghost_save_best 1` deletes last ghost If the own ghost is the last element in the vector and deleted due to using the `cl_race_ghost_save_best 1` setting then the following accesses with index `Own` were out-of-bounds. Closes #8003. --- src/game/client/components/menus_ingame.cpp | 33 ++++++++++----------- 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/src/game/client/components/menus_ingame.cpp b/src/game/client/components/menus_ingame.cpp index e75e55584..42503ee61 100644 --- a/src/game/client/components/menus_ingame.cpp +++ b/src/game/client/components/menus_ingame.cpp @@ -985,28 +985,25 @@ void CMenus::UpdateOwnGhost(CGhostItem Item) if(m_vGhosts[i].m_Own) Own = i; - if(Own != -1) + if(Own == -1) { - if(g_Config.m_ClRaceGhostSaveBest) - { - if(Item.HasFile() || !m_vGhosts[Own].HasFile()) - DeleteGhostItem(Own); - } - if(m_vGhosts[Own].m_Time > Item.m_Time) - { - Item.m_Own = true; - m_vGhosts[Own].m_Own = false; - m_vGhosts[Own].m_Slot = -1; - } - else - { - Item.m_Own = false; - Item.m_Slot = -1; - } + Item.m_Own = true; + } + else if(g_Config.m_ClRaceGhostSaveBest && (Item.HasFile() || !m_vGhosts[Own].HasFile())) + { + Item.m_Own = true; + DeleteGhostItem(Own); + } + else if(m_vGhosts[Own].m_Time > Item.m_Time) + { + Item.m_Own = true; + m_vGhosts[Own].m_Own = false; + m_vGhosts[Own].m_Slot = -1; } else { - Item.m_Own = true; + Item.m_Own = false; + Item.m_Slot = -1; } Item.m_Date = std::time(0);