Merge lp:~widelands-dev/widelands/bug-1798024-heap-use-after-free into lp:widelands

[GunChleoc]

Fix heap-use-after-free in fleet while processing EditorGameBase::cleanup_objects() when ship has already been deleted

Savegame for testing: https://bugs.launchpad.net/widelands/+bug/1796364/comments/3

[bunnybot (widelandsofficial)]

Continuous integration builds have changed state:

Travis build 4146. State: passed. Details: https://travis-ci.org/widelands/widelands/builds/442210639.
Appveyor build 3943. State: success. Details: https://ci.appveyor.com/project/widelands-dev/widelands/build/_widelands_dev_widelands_bug_1798024_heap_use_after_free-3943.

[Notabilis (notabilis27)]

Fix is looking good and I loaded the provided savegame a few times without it crashing.

review: Approve (diff, test)

[GunChleoc (gunchleoc)]

Thanks for the review!

@bunnybot merge

=== modified file 'src/economy/fleet.cc'
--- src/economy/fleet.cc	2018-09-05 06:42:21 +0000
+++ src/economy/fleet.cc	2018-10-16 13:56:45 +0000
@@ -258,7 +258,11 @@
 	portpaths_.clear();
 
 	while (!ships_.empty()) {
-		ships_.back()->set_fleet(nullptr);
+		Ship* ship = ships_.back();
+		// Check if the ship still exists to avoid heap-use-after-free when ship has already been deleted while processing EditorGameBase::cleanup_objects()
+		if (egbase.objects().object_still_available(ship)) {
+			ship->set_fleet(nullptr);
+		}
 		ships_.pop_back();
 	}