From 458a9d8950c65ab279c8658c36e751f1a47e2fde Mon Sep 17 00:00:00 2001 From: Jittapan Pluemsumran Date: Tue, 4 Jul 2023 11:39:54 +0900 Subject: [PATCH] Fixed potential crash in RODex (#7833) --- src/map/mail.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/map/mail.cpp b/src/map/mail.cpp index dcd234bca8..12e9a5bb14 100644 --- a/src/map/mail.cpp +++ b/src/map/mail.cpp @@ -190,6 +190,9 @@ enum mail_attach_result mail_setitem(map_session_data *sd, short idx, uint32 amo for( j = 0; j < MAIL_MAX_ITEM; j++ ){ if (sd->mail.item[j].nameid == 0) continue; + if (sd->inventory_data[sd->mail.item[j].index] == nullptr) { + return MAIL_ATTACH_ERROR; + } total += sd->mail.item[j].amount * ( sd->inventory_data[sd->mail.item[j].index]->weight / 10 ); } @@ -215,6 +218,9 @@ enum mail_attach_result mail_setitem(map_session_data *sd, short idx, uint32 amo if( battle_config.mail_attachment_weight ){ // Only need to sum up all entries until the new entry for( j = 0; j < i; j++ ){ + if (sd->inventory_data[sd->mail.item[j].index] == nullptr) { + return MAIL_ATTACH_ERROR; + } total += sd->mail.item[j].amount * ( sd->inventory_data[sd->mail.item[j].index]->weight / 10 ); }