[Scummvm-git-logs] scummvm master -> 559e6dafe1ea9c57dddca65d8e16e94ba88a4c40

[dreammaster]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
559e6dafe1 TITANIC: Fix access after free in filterConcepts loop


Commit: 559e6dafe1ea9c57dddca65d8e16e94ba88a4c40
    https://github.com/scummvm/scummvm/commit/559e6dafe1ea9c57dddca65d8e16e94ba88a4c40
Author: Paul Gilbert (dreammaster at scummvm.org)
Date: 2017-07-18T22:44:55-04:00

Commit Message:
TITANIC: Fix access after free in filterConcepts loop

Changed paths:
    engines/titanic/true_talk/tt_parser.cpp


diff --git a/engines/titanic/true_talk/tt_parser.cpp b/engines/titanic/true_talk/tt_parser.cpp
index 2893c50..adf0087 100644
--- a/engines/titanic/true_talk/tt_parser.cpp
+++ b/engines/titanic/true_talk/tt_parser.cpp
@@ -1609,7 +1609,9 @@ bool TTparser::checkConcept2(TTconcept *concept, int conceptMode) {
 int TTparser::filterConcepts(int conceptMode, int conceptIndex) {
 	int result = 0;
 
-	for (TTconcept *currP = _conceptP; currP && !result; currP = currP->_nextP) {
+	for (TTconcept *nextP, *currP = _conceptP; currP && !result; currP = nextP) {
+		nextP = currP->_nextP;
+
 		if (checkConcept2(currP, conceptMode)) {
 			TTconcept **ptrPP = _sentenceConcept->setConcept(conceptIndex, currP);
 			TTconcept *newConcept = new TTconcept(*currP);