Skip to content

m_TuneZone uninitialized cause OOB segfault #201

Description

@SollyBunny
#0  0x0000555555be9fff in CTuneParam::operator float (this=<optimized out>) at /TClient/src/game/gamecore.h:39
#1  CCharacter::Read (this=this@entry=0x5555592845e0, pChar=pChar@entry=0x7fffda6103b4, pExtended=pExtended@entry=0x0, IsLocal=IsLocal@entry=false)
    at /TClient/src/game/client/prediction/entities/character.cpp:1433
#2  0x0000555555bea908 in CCharacter::CCharacter
    (this=this@entry=0x5555592845e0, pGameWorld=pGameWorld@entry=0x7fffda7e5818, Id=Id@entry=5, pChar=pChar@entry=0x7fffda6103b4, pExtended=pExtended@entry=0x0)
    at /TClient/src/game/client/prediction/entities/character.cpp:1319
#3  0x0000555555bef607 in CGameWorld::NetCharAdd
    (this=this@entry=0x7fffda7e5818, ObjId=ObjId@entry=5, pCharObj=pCharObj@entry=0x7fffda6103b4, pExtended=0x0, GameTeam=0, IsLocal=<optimized out>)
    at /TClient/src/game/client/prediction/entity.h:14
#4  0x0000555555bd214c in CGameClient::UpdatePrediction (this=this@entry=0x7fffda086010) at /TClient/src/game/client/gameclient.cpp:4058
#5  0x0000555555bd760d in CGameClient::OnNewSnapshot (this=0x7fffda086010, DummySwapped=false) at /TClient/src/game/client/gameclient.cpp:2557
#6  0x00005555558d8b06 in CClient::Update (this=this@entry=0x7fffdbe1a010) at /TClient/src/engine/client/client.h:286
#7  0x00005555558da239 in CClient::Run (this=this@entry=0x7fffdbe1a010) at /TClient/src/engine/client/client.cpp:3449
#8  0x00005555558deb51 in main (argc=<optimized out>, argv=<optimized out>) at /TClient/src/engine/client/client.cpp:5281
print {m_TuneZone, m_TuneZoneOverride}
{21845, 1507524871}
// different crash
print {m_TuneZone, m_TuneZoneOverride}
{-1594056603, 605847552}

in game/client/prediction/entities/character.cpp
CCharacter::Read() which is called at the end of CCharacter::CCharacter()
on (vanilla) servers which don't send extended data
take the else path (pExtended == nullptr)
m_TuneZone and m_TuneZoneOverride are uninitialized when used in GetTuning(GetOverriddenTuneZone())
initialized after with m_TuneZoneOverride = TuneZone::OVERRIDE_NONE and SetTuneZone(...)

currently bandaid patched with ebf3239

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions