From c8af1836a07e42614c514d83638532fc393d0fc2 Mon Sep 17 00:00:00 2001
From: "jean.chalard" <jean.chalard@01922e74-a4c3-11dd-a5cd-697bfd0a0cef>
Date: Fri, 4 Sep 2009 17:21:34 +0000
Subject: [PATCH] J : * Fix a bug where some event chains could result in
 reading from a   freed memory space.

---
 projects/mtg/src/CardGui.cpp    | 14 ++++++++++++--
 projects/mtg/src/DuelLayers.cpp | 12 +++++++++---
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/projects/mtg/src/CardGui.cpp b/projects/mtg/src/CardGui.cpp
index 58184eab5..61bb4a49b 100644
--- a/projects/mtg/src/CardGui.cpp
+++ b/projects/mtg/src/CardGui.cpp
@@ -17,11 +17,21 @@ CardGui::CardGui(MTGCardInstance* card, float x, float y) : PlayGuiObject(Height
 CardGui::CardGui(MTGCardInstance* card, const Pos& ref) : PlayGuiObject(Height, ref, false), card(card) {}
 
 CardView::CardView(MTGCardInstance* card, float x, float y) : CardGui(card, x, y) {
-  card->view = this;
+  const Pos* ref = card->view;
+  while (card)
+    {
+      if (ref == card->view) card->view = this;
+      card = card->next;
+    }
 }
 
 CardView::CardView(MTGCardInstance* card, const Pos& ref) : CardGui(card, ref) {
-  card->view = this;
+  const Pos* r = card->view;
+  while (card)
+    {
+      if (r == card->view) card->view = this;
+      card = card->next;
+    }
 }
 
 void CardGui::Update(float dt)
diff --git a/projects/mtg/src/DuelLayers.cpp b/projects/mtg/src/DuelLayers.cpp
index adc24b34e..7e013176b 100644
--- a/projects/mtg/src/DuelLayers.cpp
+++ b/projects/mtg/src/DuelLayers.cpp
@@ -135,11 +135,17 @@ int DuelLayers::receiveEvent(WEvent * e){
       Pos* p;
       if (WEventZoneChange *event = dynamic_cast<WEventZoneChange*>(e))
 	{
-	  if (event->card->view)
-	    waiters.push_back(p = NEW Pos(*(event->card->view)));
+          MTGCardInstance* card = event->card;
+	  if (card->view)
+	    waiters.push_back(p = NEW Pos(*(card->view)));
 	  else
 	    waiters.push_back(p = NEW Pos(0, 0, 0, 0, 255));
-	  event->card->view = p;
+          const Pos* ref = card->view;
+          while (card)
+            {
+              if (ref == card->view) card->view = p;
+              card = card->next;
+            }
 	}
     }
   for (int i = 0; i < nbitems; ++i)