jackpoz 2a47b602d7 Core/Aura: Fix SPELL_AURA_BIND_SIGHT invalid read
Mind Vision has Aura Effect SPELL_AURA_BIND_SIGHT which adds the target to a special Map container i_objectsToSwitch, used to switch grid containers for target Creatures of this Aura Effect.

When the target is a Creature, when the Creature is removed from world it's added to i_objectsToSwitch and then to i_objectsToRemove, iterated in this order in Map::RemoveAllObjectsInRemoveList() so the reference in i_objectsToSwitch is valid.
When the target is a Player, when the Player logs out it's added to i_objectsToSwitch but then Map::RemovePlayerFromMap() deletes the Player, leaving an invalid reference in i_objectsToSwitch.

Since the whole point of i_objectsToSwitch is to store Creatures and since the stored references are used only if the condition "GetTypeId() == TYPEID_UNIT" is verified, it's safe to add only objects of TYPEID_UNIT type to the container.

Valgrind log:
 Invalid read of size 4
   at 0xC52332: Object::GetTypeId() const (Object.h:140)
   by 0xF540D3: Map::RemoveAllObjectsInRemoveList() (Map.cpp:2136)
   by 0xF53CD2: Map::DelayedUpdate(unsigned int) (Map.cpp:2087)
   by 0xF639B1: MapManager::Update(unsigned int) (MapManager.cpp:292)
   by 0x107CB40: World::Update(unsigned int) (World.cpp:2025)
   by 0xBEB263: WorldRunnable::run() (WorldRunnable.cpp:60)
   by 0x1213792: ACE_Based::Thread::ThreadTask(void*) (Threading.cpp:186)
   by 0x515EA35: ACE_OS_Thread_Adapter::invoke() (in /usr/lib/libACE-6.0.3.so)
   by 0x5F19F8D: start_thread (pthread_create.c:311)
   by 0x6A46E1C: clone (clone.S:113)
 Address 0x401eacac is 12 bytes inside a block of size 11,736 free'd
   at 0x4C2B59C: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
   by 0xD80239: Player::~Player() (Player.cpp:915)
   by 0xF4D5A2: void Map::DeleteFromWorld<Player>(Player*) (Map.cpp:319)
   by 0xF4EBBB: Map::RemovePlayerFromMap(Player*, bool) (Map.cpp:687)
   by 0xFCC18D: WorldSession::LogoutPlayer(bool) (WorldSession.cpp:531)
   by 0xF1EDD5: WorldSession::HandleLogoutRequestOpcode(WorldPacket&) (MiscHandler.cpp:403)
   by 0xFCAE37: WorldSession::Update(unsigned int, PacketFilter&) (WorldSession.cpp:312)
   by 0x107EBC6: World::UpdateSessions(unsigned int) (World.cpp:2615)
   by 0x107C94B: World::Update(unsigned int) (World.cpp:1978)
   by 0xBEB263: WorldRunnable::run() (WorldRunnable.cpp:60)
   by 0x1213792: ACE_Based::Thread::ThreadTask(void*) (Threading.cpp:186)
   by 0x515EA35: ACE_OS_Thread_Adapter::invoke() (in /usr/lib/libACE-6.0.3.so)
2013-08-26 16:49:02 +02:00
2013-01-01 00:41:01 +01:00
2013-08-25 18:48:24 +02:00
2013-01-21 02:47:51 +00:00
2013-08-18 20:11:24 +02:00
2012-10-13 03:47:14 +03:00

logo TrinityCore

Introduction

TrinityCore is a MMORPG Framework based mostly in C++.

It is derived from MaNGOS, the Massive Network Game Object Server, and is based on the code of that project with extensive changes over time to optimize, improve and cleanup the codebase at the same time as improving the in-game mechanics and functionality.

It is completely open source; community involvement is highly encouraged.

If you wish to contribute ideas or code please visit our site linked below or make pull requests to our Github repository.

For further information on the TrinityCore project, please visit our project website at TrinityCore.org.

Requirements

  • Platform: Linux, Windows or Mac
  • Processor with SSE2 support
  • ACE ≥ 5.8.3 (included for Windows)
  • MySQL ≥ 5.1.0 (included for Windows)
  • CMake ≥ 2.8.0
  • OpenSSL ≥ 1.0.0
  • GCC ≥ 4.3 (Linux only)
  • MS Visual Studio ≥ 9 (2008) (Windows only)

Install

Detailed installation guides are available in the wiki for Windows, Linux and Mac OSX.

Reporting issues

Issues can be reported via the Github issue tracker.

Please take the time to review existing issues before submitting your own to prevent duplicates.

In addition, thoroughly read through the issue tracker guide to ensure your report contains the required information. Incorrect or poorly formed reports are wasteful and are subject to deletion.

Submitting fixes

Fixes are submitted as pull requests via Github. For more information on how to properly submit a pull request, read the how-to: maintain a remote fork.

License: GPL 2.0

Read file COPYING

Authors & Contributors

Read file THANKS

Site

Wiki

Documentation (powered by Doxygen)

Forums

Description
Server emulator for World of Warcraft 3.3.5.12340 and other versions
Readme 10 GiB
Languages
C++ 89.1%
C 10.4%
CMake 0.4%