diff --git a/gflib/sprite.c b/gflib/sprite.c index 2e96acf2c7..c7e3d09a32 100644 --- a/gflib/sprite.c +++ b/gflib/sprite.c @@ -878,12 +878,14 @@ void ResetAllSprites(void) ResetSprite(&gSprites[i]); } +// UB: template pointer may point to freed temporary storage void FreeSpriteTiles(struct Sprite *sprite) { if (sprite->template->tileTag != 0xFFFF) FreeSpriteTilesByTag(sprite->template->tileTag); } +// UB: template pointer may point to freed temporary storage void FreeSpritePalette(struct Sprite *sprite) { FreeSpritePaletteByTag(sprite->template->paletteTag); diff --git a/gflib/sprite.h b/gflib/sprite.h index 9753837fd7..c9ba9585d9 100644 --- a/gflib/sprite.h +++ b/gflib/sprite.h @@ -182,6 +182,10 @@ struct SpriteTemplate SpriteCallback callback; }; +// UB: template pointer is often used to point to temporary storage, +// then later dereferenced after being freed. Usually this won't +// be visible in-game, but this is (part of) what causes the item +// icon palette to flicker when changing items in the bag. struct Sprite { /*0x00*/ struct OamData oam; diff --git a/src/mevent2.c b/src/mevent2.c index 0bbaf6db82..2991ac27ca 100755 --- a/src/mevent2.c +++ b/src/mevent2.c @@ -484,9 +484,13 @@ static void sub_801B7D8(u32 command) } if (dest == NULL) + { AGB_ASSERT(0); + } else if (++(*dest) > 999) + { *dest = 999; + } } }