From 5bd81448539b63519d70ba85d4833e446f0597fe Mon Sep 17 00:00:00 2001 From: frosch Date: Wed, 12 May 2021 23:40:03 +0200 Subject: Fix #9256, 12e43c697d2: invalid read after free. (#9258) This also changes ScriptEventVehicleAutoReplaced when replacing wagons: The event is now only spawned, if the head engine changes, so only if the VehicleID of the consist changes. Previously replacing wagons spawned an event with OldVehicleID==NewVehicleID. --- src/autoreplace_cmd.cpp | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/autoreplace_cmd.cpp b/src/autoreplace_cmd.cpp index d9996bb11..d5f031aa6 100644 --- a/src/autoreplace_cmd.cpp +++ b/src/autoreplace_cmd.cpp @@ -614,6 +614,7 @@ static CommandCost ReplaceChain(Vehicle **chain, DoCommandFlag flags, bool wagon /* Success ! */ if ((flags & DC_EXEC) != 0 && new_head != old_head) { *chain = new_head; + AI::NewEvent(old_head->owner, new ScriptEventVehicleAutoReplaced(old_head->index, new_head->index)); } /* Transfer cargo of old vehicles and sell them */ @@ -631,10 +632,7 @@ static CommandCost ReplaceChain(Vehicle **chain, DoCommandFlag flags, bool wagon cost.AddCost(DoCommand(0, w->index, 0, flags | DC_AUTOREPLACE, GetCmdSellVeh(w))); if ((flags & DC_EXEC) != 0) { old_vehs[i] = nullptr; - if (i == 0) { - AI::NewEvent(old_head->owner, new ScriptEventVehicleAutoReplaced(old_head->index, new_head->index)); - old_head = nullptr; - } + if (i == 0) old_head = nullptr; } } -- cgit v1.2.3-70-g09d2