Re: [Freeciv-Dev] Core dump in aihand.c

[David Pfitzner <dwp@xxxxxxxxxxxxxx>]

Jake Kesinger wrote:

>              unit_list_iterate(pcity->units_supported, punit)
>                if (punit != defender && pcity->shield_surplus < 0) {
>                  /* the defender MUST NOT be disbanded! -- Syela */
>                  flog(LOG_DEBUG, "Disbanding %s's %s",
>                       pcity->name, unit_types[punit->type].name);
>                  pack.unit_id = punit->id;
>                  handle_unit_disband(pplayer, &pack);

Here is the problem, one which has occured previously in other parts 
of the code.  If punit is a boat with passengers, and one of the 
passengers is next in the list, the iterator points to freed memory
after the disband.  This should be fixed now in cvs (changed to use 
handle_unit_disband_safe, which was written previously to solve this 
particular sort of bug).

Thanks for the bug report,

-- David