Core/Vehicles: Fixed accessing freed memory in Vehicle::RemoveAllPassengers - _pendingJoinEvents needs to be cleaned from events that had already executed or were aborted

2 files changed, 28 insertions, 1 deletions

diff --git a/src/server/game/Entities/Vehicle/Vehicle.cpp b/src/server/game/Entities/Vehicle/Vehicle.cpp
index 1f6c62f0579..05a86653c55 100755
--- a/src/server/game/Entities/Vehicle/Vehicle.cpp
+++ b/src/server/game/Entities/Vehicle/Vehicle.cpp
@@ -256,7 +256,7 @@ void Vehicle::RemoveAllPassengers()
 
     /// Setting to_Abort to true will cause @VehicleJoinEvent::Abort to be executed on next @Unit::UpdateEvents call
     /// This will properly "reset" the pending join process for the passenger.
-    while (_pendingJoinEvents.size())
+    while (!_pendingJoinEvents.empty())
     {
         VehicleJoinEvent* e = _pendingJoinEvents.front();
         e->to_Abort = true;
@@ -706,6 +706,31 @@ void Vehicle::CancelJoinEvent(VehicleJoinEvent* e)
 }
 
 /**
+ * @fn void Vehicle::RemovePendingEvent(VehicleJoinEvent* e)
+ *
+ * @brief Removes @VehicleJoinEvent objects from pending join event store.
+ *        This method only removes it after it's executed or aborted to prevent leaving
+ *        pointers to deleted events.
+ *
+ * @author Shauren
+ * @date 22-2-2013
+ *
+ * @param [in] e The VehicleJoinEvent* to remove from pending event store.
+ */
+
+void Vehicle::RemovePendingEvent(VehicleJoinEvent* e)
+{
+    for (std::deque<VehicleJoinEvent*>::iterator itr = _pendingJoinEvents.begin(); itr != _pendingJoinEvents.end(); ++itr)
+    {
+        if (*itr == e)
+        {
+            _pendingJoinEvents.erase(itr);
+            break;
+        }
+    }
+}
+
+/**
  * @fn bool VehicleJoinEvent::Execute(uint64, uint32)
  *
  * @brief Actually adds the passenger @Passenger to vehicle @Target.
diff --git a/src/server/game/Entities/Vehicle/Vehicle.h b/src/server/game/Entities/Vehicle/Vehicle.h
index 7ec0df8e533..e1263a8e661 100644
--- a/src/server/game/Entities/Vehicle/Vehicle.h
+++ b/src/server/game/Entities/Vehicle/Vehicle.h
@@ -101,6 +101,7 @@ class Vehicle : public TransportBase
         Position m_lastShootPos;
         std::deque<VehicleJoinEvent*> _pendingJoinEvents;   ///< Collection of delayed join events for prospective passengers
         void CancelJoinEvent(VehicleJoinEvent* e);
+        void RemovePendingEvent(VehicleJoinEvent* e);
 };
 
 class VehicleJoinEvent : public BasicEvent
@@ -108,6 +109,7 @@ class VehicleJoinEvent : public BasicEvent
     friend class Vehicle;
     protected:
         VehicleJoinEvent(Vehicle* v, Unit* u) : Target(v), Passenger(u), Seat(Target->Seats.end()) {}
+        ~VehicleJoinEvent() { Target->RemovePendingEvent(this); }
         bool Execute(uint64, uint32);
         void Abort(uint64);