summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorrubidium <rubidium@openttd.org>2010-07-05 21:07:31 +0000
committerrubidium <rubidium@openttd.org>2010-07-05 21:07:31 +0000
commit5ca40984437e162bf781a36c69aa9e5bb451cfb4 (patch)
treea2c24307a408fed4dee983a4a4908d5ff703a8bd
parent26404de5e685f7088a2446bee5848f68b47879a7 (diff)
downloadopenttd-5ca40984437e162bf781a36c69aa9e5bb451cfb4.tar.xz
(svn r20082) -Fix [FS#3899]: reading deleted memory when selecting a NewGRF in the content download window of which the data has not been acquired from the content server. The crash would occur after the content server's reply was processed and the ContentInfo object was replaced with another.
-rw-r--r--src/network/network_content.cpp12
1 files changed, 10 insertions, 2 deletions
diff --git a/src/network/network_content.cpp b/src/network/network_content.cpp
index 062586593..f70f0e724 100644
--- a/src/network/network_content.cpp
+++ b/src/network/network_content.cpp
@@ -132,8 +132,16 @@ DEF_CONTENT_RECEIVE_COMMAND(Client, PACKET_CONTENT_SERVER_INFO)
if (StrEmpty(ci->name)) strecpy(ci->name, ici->name, lastof(ci->name));
if (ici->IsSelected()) ci->state = ici->state;
- delete ici;
- *iter = ci;
+ /*
+ * As ici might be selected by the content window we cannot delete that.
+ * However, we want to keep most of the values of ci, except the values
+ * we (just) already preserved. As there are already allocated blobs of
+ * memory and more may be added, we cannot simply copy ci to ici as that
+ * might cause a leak of memory. As such we need to swap the data and
+ * then delete the memory we allocated here.
+ */
+ Swap(*ici, *ci);
+ delete ci;
this->OnReceiveContentInfo(ci);
return true;