Skip to content

Commit 4129551

Browse files
committed
Fixes pointer access violation when docked ships warp out by moving dock_undock_all call to red_alert_delete.
It was previously thought that dock_undock_all() was supposed to be within ship_cleanup() and was safe to do so. Nope. dock_evaluate_all_docked_objects makes the assumption that the dock_list is still valid, so if the function called by it happens to nuke the dock_list (like with ship_cleanup) then it'll work with invalid pointer values.
1 parent 36c134f commit 4129551

File tree

3 files changed

+2
-2
lines changed

3 files changed

+2
-2
lines changed

code/missionui/redalert.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -797,6 +797,7 @@ void red_alert_delete_ship(int shipnum, int ship_state)
797797
}
798798

799799
Objects[shipp->objnum].flags.set(Object::Object_Flags::Should_be_dead);
800+
dock_undock_all(&Objects[shipp->objnum]);
800801
ship_cleanup(shipnum, cleanup_mode);
801802
}
802803

code/object/objectdock.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,7 @@ void dock_undock_objects(object *objp1, object *objp2);
131131
/**
132132
* @brief Undocks everything from the given object
133133
* @note This is a slow method. use dock_free_dock_list() when doing object cleanup.
134+
* @note Currently, this function cannot be called from within ship_cleanup() [Github Issue #1177:https://github.com/scp-fs2open/fs2open.github.com/issues/1177]
134135
*/
135136
void dock_undock_all(object *objp);
136137

code/ship/ship.cpp

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7530,8 +7530,6 @@ void ship_cleanup(int shipnum, int cleanup_mode)
75307530
// Goober5000 - lastly, clear out the dead-docked list, per Mantis #2294
75317531
// (for exploding ships, this list should have already been cleared by now, via
75327532
// do_dying_undock_physics, except in the case of the destroy-instantly sexp)
7533-
// z64555 - Also clear out the docked list, since a red-alert-carry ship could be docked with somebody
7534-
dock_undock_all(objp);
75357533
dock_dead_undock_all(objp);
75367534
}
75377535

0 commit comments

Comments
 (0)