Fix: heap-use-after-free in doforging. Fixes #416.

Resulted from 01a17b1, where weights were recalculated after the forging materials were used up.
elunna · Jul 31, 2023 · a7ae5ae · a7ae5ae
1 parent 0f63f23
commit a7ae5ae
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 6 deletions.
diff --git a/hackem_changelog.txt b/hackem_changelog.txt
@@ -16,6 +16,7 @@
 
 Version 1.2.1 (unreleased)
 
+Fix: heap-use-after-free in doforging. Fixes #416.
 Revert Und-Vam
 Put trench coat with non-randomized cloaks.
 Fix: Update MAGICTILENO.

diff --git a/src/fountain.c b/src/fountain.c
@@ -807,19 +807,19 @@ doforging(void)
             if (obj2->otyp == recipe->typ2)
                 obj2->quan -= recipe->quan_typ2;
 
-            /* delete recipe objects if quantity reaches zero */
-            if (obj1->quan <= 0)
-                delobj(obj1);
-            if (obj2->quan <= 0)
-                delobj(obj2);
-
             /* recalculate weight of the recipe objects if
                using a stack */
             if (obj1->quan > 0)
                 obj1->owt = weight(obj1);
             if (obj2->quan > 0)
                 obj2->owt = weight(obj2);
 
+            /* delete recipe objects if quantity reaches zero */
+            if (obj1->quan <= 0)
+                delobj(obj1);
+            if (obj2->quan <= 0)
+                delobj(obj2);
+
             /* forged object is created */
             output = addinv(output);
             /* prevent large stacks of ammo-type weapons from being