Skip to content

fix(Core/OutdoorPvP): Fix use-after-free in DelCapturePoint #25229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
blinkysc wants to merge 1 commit into
base: master
Choose a base branch
from
+3 −3
Open

fix(Core/OutdoorPvP): Fix use-after-free in DelCapturePoint #25229

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions src/server/game/OutdoorPvP/OutdoorPvP.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,15 +215,15 @@ bool OPvPCapturePoint::DelObject(uint32 type)

bool OPvPCapturePoint::DelCapturePoint()
{
sObjectMgr->DeleteGOData(m_capturePointSpawnId);
m_capturePointSpawnId = 0;

if (_capturePoint)
{
_capturePoint->SetRespawnTime(0); // not save respawn time
_capturePoint->Delete();
Copy link

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

_capturePoint remains non-null after calling _capturePoint->Delete(). If Delete() frees the object (or makes the pointer invalid), leaving the member pointer set can enable later use-after-free via any subsequent _capturePoint checks. Consider clearing the member immediately after deletion (e.g., set _capturePoint = nullptr; after Delete()) to make the object lifecycle explicit and prevent accidental reuse.

Suggested change
_capturePoint->Delete();
_capturePoint->Delete();
_capturePoint = nullptr;

Copilot uses AI. Check for mistakes.
}

sObjectMgr->DeleteGOData(m_capturePointSpawnId);
m_capturePointSpawnId = 0;
Comment on lines +224 to +225
Copy link

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DeleteGOData(m_capturePointSpawnId) is called unconditionally. If m_capturePointSpawnId can legitimately be 0 (it’s set to 0 here and likely used as a sentinel), consider guarding the delete with if (m_capturePointSpawnId) to avoid relying on implicit behavior of DeleteGOData(0) and to make intent clearer.

Suggested change
sObjectMgr->DeleteGOData(m_capturePointSpawnId);
m_capturePointSpawnId = 0;
if (m_capturePointSpawnId)
{
sObjectMgr->DeleteGOData(m_capturePointSpawnId);
m_capturePointSpawnId = 0;
}

Copilot uses AI. Check for mistakes.

return true;
}

Expand Down
Loading