Skip to content

Commit 04ebd46

Browse files
Fix potential for projectile leak
1 parent 06d1ccc commit 04ebd46

1 file changed

Lines changed: 16 additions & 11 deletions

File tree

src/Combat.cpp

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -804,8 +804,20 @@ static void projectileHit(CNSocket* sock, CNPacketData* data) {
804804
sP_CL2FE_REQ_PC_ROCKET_STYLE_HIT* pkt = (sP_CL2FE_REQ_PC_ROCKET_STYLE_HIT*)data->buf;
805805
Player* plr = PlayerManager::getPlayer(sock);
806806

807+
if (plr == nullptr) {
808+
return;
809+
}
810+
811+
if (Bullets.find(plr->iID) == Bullets.end() || Bullets[plr->iID].find(pkt->iBulletID) == Bullets[plr->iID].end()) {
812+
std::cout << "[WARN] projectileHit: bullet not found" << std::endl;
813+
return;
814+
}
815+
816+
// Remove the bullet immediately to prevent leaking it in early return paths
817+
Bullet bullet = Bullets[plr->iID][pkt->iBulletID];
818+
Bullets[plr->iID].erase(pkt->iBulletID);
819+
807820
if (pkt->iTargetCnt == 0) {
808-
Bullets[plr->iID].erase(pkt->iBulletID);
809821
// no targets hit, don't send response
810822
return;
811823
}
@@ -848,11 +860,6 @@ static void projectileHit(CNSocket* sock, CNPacketData* data) {
848860
sAttackResult* respdata = (sAttackResult*)(respbuf + sizeof(sP_FE2CL_PC_GRENADE_STYLE_HIT));
849861

850862
resp->iTargetCnt = pkt->iTargetCnt;
851-
if (Bullets.find(plr->iID) == Bullets.end() || Bullets[plr->iID].find(pkt->iBulletID) == Bullets[plr->iID].end()) {
852-
std::cout << "[WARN] projectileHit: bullet not found" << std::endl;
853-
return;
854-
}
855-
Bullet* bullet = &Bullets[plr->iID][pkt->iBulletID];
856863

857864
for (int i = 0; i < pkt->iTargetCnt; i++) {
858865
if (NPCManager::NPCs.find(pktdata[i]) == NPCManager::NPCs.end()) {
@@ -870,10 +877,10 @@ static void projectileHit(CNSocket* sock, CNPacketData* data) {
870877
Mob* mob = (Mob*)npc;
871878
std::pair<int, int> damage;
872879

873-
damage.first = pkt->iTargetCnt > 1 ? bullet->groupDamage : bullet->pointDamage;
880+
damage.first = pkt->iTargetCnt > 1 ? bullet.groupDamage : bullet.pointDamage;
874881

875882
int difficulty = (int)mob->data["m_iNpcLevel"];
876-
damage = getDamage(damage.first, (int)mob->data["m_iProtection"], true, bullet->weaponBoost, Nanos::nanoStyle(plr->activeNano), (int)mob->data["m_iNpcStyle"], difficulty);
883+
damage = getDamage(damage.first, (int)mob->data["m_iProtection"], true, bullet.weaponBoost, Nanos::nanoStyle(plr->activeNano), (int)mob->data["m_iNpcStyle"], difficulty);
877884

878885
damage.first = mob->takeDamage(sock, damage.first);
879886

@@ -885,11 +892,9 @@ static void projectileHit(CNSocket* sock, CNPacketData* data) {
885892

886893
resp->iPC_ID = plr->iID;
887894
resp->iBulletID = pkt->iBulletID;
888-
resp->Bullet.iID = bullet->bulletType;
895+
resp->Bullet.iID = bullet.bulletType;
889896
sock->sendPacket((void*)respbuf, P_FE2CL_PC_GRENADE_STYLE_HIT, resplen);
890897
PlayerManager::sendToViewable(sock, (void*)respbuf, P_FE2CL_PC_GRENADE_STYLE_HIT, resplen);
891-
892-
Bullets[plr->iID].erase(resp->iBulletID);
893898
}
894899

895900
static void playerTick(CNServer *serv, time_t currTime) {

0 commit comments

Comments
 (0)