Segfault in unit.c & dangling pointer

Originally posted by [b]Kazuki-Haru[/b]
[b]Issue:[/b]
[CODE]
Program terminated with signal 11, Segmentation fault.
#0 0x000000000051185b in unit_walktoxy_timer (tid=9268, tick=494032895, id=2089935, data=<value optimized out>) at unit.c:194
194 if( g->member[i].online && g->member[i].sd && sd->bl.m == g->member[i].sd->bl.m && check_distance_bl(&sd->bl, &g->member[i].sd->bl, 2) )
[/CODE]


[b]Suspected cause:[/b]
When a guild is broken, [b]gmaster_flag[/b] is not cleared from the guild leader. Guild aura code uses the pointer stored on gmaster_flag directly to access guild data. Under some bizarre circumstances which I have not managed to duplicate the guild aura code could reach this loop using the dangling pointer stored in gmaster_flag (now in [b]g[/b]):
[CODE]
for( i = 0; i < g->max_member; i++ )
{
if( g->member[i].online && g->member[i].sd && sd->bl.m == g->member[i].sd->bl.m && check_distance_bl(&sd->bl, &g->member[i].sd->bl, 2) )
{// perform the aura on the member as appropriate
skill_guildaura_sub(g->member[i].sd, sd->bl.id, strvit, agidex);
}
}
[/CODE]
Which will segfault if [b]g->max_member[/b] is some random data.

NOTE: This flaw was unburrowed by r15084.


[b]Fix:[/b]
gmaster_flag should be cleared inside guild_broken():
[CODE]
if((sd=g->member[i].sd)!=NULL){
if(sd->state.storage_flag == 2)
storage_guild_storage_quit(sd,1);
+ sd->state.gmaster_flag=0;
sd->status.guild_id=0;
clif_guild_broken(g->member[i].sd,0);
clif_charnameupdate(sd); // [LuzZza]
}
[/CODE]