Browse Source

Fixed bug with BoundingBox Lua constructor
Fixed use-after-free in DestroyLight

ghassanpl 9 years ago
parent
commit
47b6e62744
2 changed files with 5 additions and 4 deletions
  1. 4 3
      src/rlgl.c
  2. 1 1
      src/rlua.h

+ 4 - 3
src/rlgl.c

@@ -2559,11 +2559,13 @@ void DestroyLight(Light light)
 {
 {
     if (light != NULL)
     if (light != NULL)
     {
     {
+				int light_id = light->id;
+
         // Free dynamic memory allocation
         // Free dynamic memory allocation
-        free(lights[light->id]);
+        free(lights[light_id]);
         
         
         // Remove *obj from the pointers array
         // Remove *obj from the pointers array
-        for (int i = light->id; i < lightsCount; i++)
+        for (int i = light_id; i < lightsCount; i++)
         {
         {
             // Resort all the following pointers of the array
             // Resort all the following pointers of the array
             if ((i + 1) < lightsCount)
             if ((i + 1) < lightsCount)
@@ -2571,7 +2573,6 @@ void DestroyLight(Light light)
                 lights[i] = lights[i + 1];
                 lights[i] = lights[i + 1];
                 lights[i]->id = lights[i + 1]->id;
                 lights[i]->id = lights[i + 1]->id;
             }
             }
-            else free(lights[i]);
         }
         }
         
         
         // Decrease enabled physic objects count
         // Decrease enabled physic objects count

+ 1 - 1
src/rlua.h

@@ -768,7 +768,7 @@ static int lua_BoundingBox(lua_State* L)
 {
 {
     Vector3 min = LuaGetArgument_Vector3(L, 1);
     Vector3 min = LuaGetArgument_Vector3(L, 1);
     Vector3 max = LuaGetArgument_Vector3(L, 2);
     Vector3 max = LuaGetArgument_Vector3(L, 2);
-    LuaPush_BoundingBox(L, (BoundingBox) { { min.x, min.y }, { max.x, max.y } });
+    LuaPush_BoundingBox(L, (BoundingBox) { { min.x, min.y, min.z }, { max.x, max.y, max.z } });
     return 1;
     return 1;
 }
 }