Fix: heap-use-after-free when magic beam trap is destroyed by fire ra…

…y when situated on ice. Fixes #483
elunna · Sep 25, 2023 · 6244ebc · 6244ebc
1 parent e356f90
commit 6244ebc
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/trap.c b/src/trap.c
@@ -1194,12 +1194,12 @@ unsigned trflags;
         seetrap(trap);
         if (isok(trap->launch.x, trap->launch.y)
             && IS_STWALL(levl[trap->launch.x][trap->launch.y].typ)) {
-
+            trap->once = 1; /* Set before dobuzz because a fire ray can
+                             * destroy a magic beam trap on top of ice. */
             dobuzz(randomray(), 8,
                    trap->launch.x, trap->launch.y,
                    sgn(trap->tx - trap->launch.x),
                    sgn(trap->ty - trap->launch.y), FALSE);
-            trap->once = 1;
         } else {
             deltrap(trap);
             newsym(u.ux, u.uy);