Fix: heap-use-after-free (bones).

Found in GnollHack in regards to HTML dumplogs. Fix is also present in
NetHack 3.7.

Author: k21971

doc/evilhack-changelog.md

@@ -3342,4 +3342,5 @@ The following changes to date are:
 - Restore auto-suppression of some dangerous attacks
 - Fix: crash when examining discoveries with '`' in certain cases
 - Fix: allow spear traps to be disarmed
+- Fix: heap-use-after-free (bones)
 

src/bones.c

@@ -788,9 +788,9 @@ struct obj *corpse;
     store_savefileinfo(fd);
     bwrite(fd, (genericptr_t) &c, sizeof c);
     bwrite(fd, (genericptr_t) bonesid, (unsigned) c); /* DD.nnn */
-    savefruitchn(fd, WRITE_SAVE | FREE_SAVE);
+    savefruitchn(fd, WRITE_SAVE);
     update_mlstmv(); /* update monsters for eventual restoration */
-    savelev(fd, ledger_no(&u.uz), WRITE_SAVE | FREE_SAVE);
+    savelev(fd, ledger_no(&u.uz), WRITE_SAVE);
     bclose(fd);
     commit_bonesfile(&u.uz);
     compress_bonesfile();