[Bug 54856] atlantik: another SIGSEGV in trade

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
     
http://bugs.kde.org/show_bug.cgi?id=54856     




------- Additional Comments From [email protected]  2003-02-22 18:44 -------
I found this function: 
 
void Atlantik::removeGUI(Player *player) 
{ 
	// Find and remove portfolioview 
	PortfolioView *portfolioView = findPortfolioView(player); 
	if (portfolioView) 
	{ 
		m_portfolioViews.remove(portfolioView); 
		delete portfolioView; 
	} 
 
	// TODO: Remove tokens from board 
} 
 
It seems easy to just add a call to delete the token here, but the function above is 
never called. The portfolioview is removed anyway, but not in the code above, but in 
"void Atlantik::playerChanged(Player *)": 
 
void Atlantik::playerChanged(Player *player) 
{ 
	PortfolioView *portfolioView = findPortfolioView(player); 
	if (portfolioView && player->gameId() == -1) 
	{ 
		m_portfolioViews.remove(portfolioView); 
		delete portfolioView; 
	} 
	else if (!portfolioView && player->gameId() != -1) 
		addPortfolioView(player); 
. 
. 
. 
 
The deletes in both code pieces above are serious memory errors. First the code calls 
m_portfolioViews.remove(portfilioView), and then it deletes portfiloiView. The problem is 
that the constructor for Atlantik calls m_portfolioViews.setAutoDelete(true). The 
documentation for "bool QPtrList::remove (const type *)" says: 
 
	"The removed item is deleted if auto-deletion is enabled." 
 
So portfolioView is deleted twice.