[Scummvm-git-logs] scummvm master -> e46d5efaea1479b16a8271f7bdb8c95d6368a813

[bluegr]

This automated email contains information about 2 new commits which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
373f0c91be SLUDGE: fix use-after-free in PeopleManager::killMostPeople
e46d5efaea SLUDGE: fix use-after-free in RegionManager::removeScreenRegion


Commit: 373f0c91bec0bb5b3beba44159649a3b6003ffcd
    https://github.com/scummvm/scummvm/commit/373f0c91bec0bb5b3beba44159649a3b6003ffcd
Author: Sebastian Krzyszkowiak (dos at dosowisko.net)
Date: 2019-06-17T22:11:14+03:00

Commit Message:
SLUDGE: fix use-after-free in PeopleManager::killMostPeople

Changed paths:
    engines/sludge/people.cpp


diff --git a/engines/sludge/people.cpp b/engines/sludge/people.cpp
index 2d29319..6cc0ddb 100644
--- a/engines/sludge/people.cpp
+++ b/engines/sludge/people.cpp
@@ -837,7 +837,7 @@ void PeopleManager::killMostPeople() {
 	for (OnScreenPersonList::iterator it = _allPeople->begin(); it != _allPeople->end(); ++it) {
 		if (!((*it)->extra & EXTRA_NOREMOVE)) {
 			OnScreenPerson *killPeople = (*it);
-			_allPeople->reverse_erase(it);
+			it = _allPeople->reverse_erase(it);
 
 			// Gone from the list... now free some memory
 			if (killPeople->continueAfterWalking)


Commit: e46d5efaea1479b16a8271f7bdb8c95d6368a813
    https://github.com/scummvm/scummvm/commit/e46d5efaea1479b16a8271f7bdb8c95d6368a813
Author: Sebastian Krzyszkowiak (dos at dosowisko.net)
Date: 2019-06-17T22:11:14+03:00

Commit Message:
SLUDGE: fix use-after-free in RegionManager::removeScreenRegion

Changed paths:
    engines/sludge/region.cpp


diff --git a/engines/sludge/region.cpp b/engines/sludge/region.cpp
index 4410951..062b355 100644
--- a/engines/sludge/region.cpp
+++ b/engines/sludge/region.cpp
@@ -67,7 +67,7 @@ void RegionManager::removeScreenRegion(int objectNum) {
 				_overRegion = nullptr;
 			delete killMe;
 			killMe = nullptr;
-			_allScreenRegions->reverse_erase(it);
+			it = _allScreenRegions->reverse_erase(it);
 		}
 	}
 }