fix(Core/Movement): Fix use-after-free in WaypointMovementGenerator (#25270)

Co-authored-by: blinkysc <blinkysc@users.noreply.github.com>
Co-authored-by: Shauren <shauren.trinity@gmail.com>
Co-authored-by: ccrs <ccrs@users.noreply.github.com>
This commit is contained in:
blinkysc
2026-03-27 16:26:24 -05:00
committed by GitHub
parent 3bdb072396
commit 1520a6f055
2 changed files with 35 additions and 21 deletions
+2 -2
View File
@@ -879,10 +879,10 @@ void MotionMaster::MoveDistract(uint32 timer)
void MotionMaster::Mutate(MovementGenerator* m, MovementSlot slot)
{
bool const delayed = (_cleanFlag & MMCF_UPDATE);
while (MovementGenerator* curr = Impl[slot])
{
bool delayed = (_top == slot && (_cleanFlag & MMCF_UPDATE));
// clear slot AND decrease top immediately to avoid crashes when referencing null top in DirectDelete
Impl[slot] = nullptr;
while (!empty() && !top())