浏览代码

Fixed bug with BoundingBox Lua constructor

Fixed use-after-free in DestroyLight
pull/175/head
ghassanpl 8 年前
父节点
当前提交
47b6e62744
共有 2 个文件被更改,包括 5 次插入4 次删除
  1. +4
    -3
      src/rlgl.c
  2. +1
    -1
      src/rlua.h

+ 4
- 3
src/rlgl.c 查看文件

@ -2559,11 +2559,13 @@ void DestroyLight(Light light)
{
if (light != NULL)
{
int light_id = light->id;
// Free dynamic memory allocation
free(lights[light->id]);
free(lights[light_id]);
// Remove *obj from the pointers array
for (int i = light->id; i < lightsCount; i++)
for (int i = light_id; i < lightsCount; i++)
{
// Resort all the following pointers of the array
if ((i + 1) < lightsCount)
@ -2571,7 +2573,6 @@ void DestroyLight(Light light)
lights[i] = lights[i + 1];
lights[i]->id = lights[i + 1]->id;
}
else free(lights[i]);
}
// Decrease enabled physic objects count

+ 1
- 1
src/rlua.h 查看文件

@ -768,7 +768,7 @@ static int lua_BoundingBox(lua_State* L)
{
Vector3 min = LuaGetArgument_Vector3(L, 1);
Vector3 max = LuaGetArgument_Vector3(L, 2);
LuaPush_BoundingBox(L, (BoundingBox) { { min.x, min.y }, { max.x, max.y } });
LuaPush_BoundingBox(L, (BoundingBox) { { min.x, min.y, min.z }, { max.x, max.y, max.z } });
return 1;
}

正在加载...
取消
保存