Fixed bug with BoundingBox Lua constructor

Fixed use-after-free in DestroyLight

2 files changed, 5 insertions, 4 deletions

diff --git a/src/rlgl.c b/src/rlgl.c
index d027495f..6fb4bf3d 100644
--- a/src/rlgl.c
+++ b/src/rlgl.c
@@ -2559,11 +2559,13 @@ void DestroyLight(Light light)
 {
     if (light != NULL)
     {
+				int light_id = light->id;
+
         // Free dynamic memory allocation
-        free(lights[light->id]);
+        free(lights[light_id]);
         
         // Remove *obj from the pointers array
-        for (int i = light->id; i < lightsCount; i++)
+        for (int i = light_id; i < lightsCount; i++)
         {
             // Resort all the following pointers of the array
             if ((i + 1) < lightsCount)
@@ -2571,7 +2573,6 @@ void DestroyLight(Light light)
                 lights[i] = lights[i + 1];
                 lights[i]->id = lights[i + 1]->id;
             }
-            else free(lights[i]);
         }
         
         // Decrease enabled physic objects count
diff --git a/src/rlua.h b/src/rlua.h
index fb3a6698..85853793 100644
--- a/src/rlua.h
+++ b/src/rlua.h
@@ -768,7 +768,7 @@ static int lua_BoundingBox(lua_State* L)
 {
     Vector3 min = LuaGetArgument_Vector3(L, 1);
     Vector3 max = LuaGetArgument_Vector3(L, 2);
-    LuaPush_BoundingBox(L, (BoundingBox) { { min.x, min.y }, { max.x, max.y } });
+    LuaPush_BoundingBox(L, (BoundingBox) { { min.x, min.y, min.z }, { max.x, max.y, max.z } });
     return 1;
 }