ddnet/src/game/client/prediction/entity.cpp
Robert Müller 2df4c4c668 Fix heap-use-after-free in CGameWorld::RemoveEntity
Entities have a pointer to their parent entity. If the parent entity is freed first, then freeing the child will cause access to the already freed parent.

This is fixed by adding a child pointer and clearing the child and parent pointers when either child or parent is freed.
2022-06-26 11:28:23 +02:00

44 lines
1.1 KiB
C++

/* (c) Magnus Auvinen. See licence.txt in the root of the distribution for more information. */
/* If you are missing that file, acquire a complete release at teeworlds.com. */
#include "entity.h"
#include <game/collision.h>
//////////////////////////////////////////////////
// Entity
//////////////////////////////////////////////////
CEntity::CEntity(CGameWorld *pGameWorld, int ObjType, vec2 Pos, int ProximityRadius)
{
m_pGameWorld = pGameWorld;
m_ObjType = ObjType;
m_Pos = Pos;
m_ProximityRadius = ProximityRadius;
m_MarkedForDestroy = false;
m_ID = -1;
m_pPrevTypeEntity = 0;
m_pNextTypeEntity = 0;
m_SnapTicks = -1;
// DDRace
m_pParent = nullptr;
m_pChild = nullptr;
m_DestroyTick = -1;
m_LastRenderTick = -1;
}
CEntity::~CEntity()
{
if(GameWorld())
GameWorld()->RemoveEntity(this);
}
bool CEntity::GameLayerClipped(vec2 CheckPos)
{
return round_to_int(CheckPos.x) / 32 < -200 || round_to_int(CheckPos.x) / 32 > Collision()->GetWidth() + 200 ||
round_to_int(CheckPos.y) / 32 < -200 || round_to_int(CheckPos.y) / 32 > Collision()->GetHeight() + 200;
}