Skip to content

m_TuneZone uninitialized cause OOB segfault #201

Description

@SollyBunny
#0  0x0000555555be9fff in CTuneParam::operator float (this=<optimized out>) at /TClient/src/game/gamecore.h:39
#1  CCharacter::Read (this=this@entry=0x5555592845e0, pChar=pChar@entry=0x7fffda6103b4, pExtended=pExtended@entry=0x0, IsLocal=IsLocal@entry=false)
    at /TClient/src/game/client/prediction/entities/character.cpp:1433
#2  0x0000555555bea908 in CCharacter::CCharacter
    (this=this@entry=0x5555592845e0, pGameWorld=pGameWorld@entry=0x7fffda7e5818, Id=Id@entry=5, pChar=pChar@entry=0x7fffda6103b4, pExtended=pExtended@entry=0x0)
    at /TClient/src/game/client/prediction/entities/character.cpp:1319
#3  0x0000555555bef607 in CGameWorld::NetCharAdd
    (this=this@entry=0x7fffda7e5818, ObjId=ObjId@entry=5, pCharObj=pCharObj@entry=0x7fffda6103b4, pExtended=0x0, GameTeam=0, IsLocal=<optimized out>)
    at /TClient/src/game/client/prediction/entity.h:14
#4  0x0000555555bd214c in CGameClient::UpdatePrediction (this=this@entry=0x7fffda086010) at /TClient/src/game/client/gameclient.cpp:4058
#5  0x0000555555bd760d in CGameClient::OnNewSnapshot (this=0x7fffda086010, DummySwapped=false) at /TClient/src/game/client/gameclient.cpp:2557
#6  0x00005555558d8b06 in CClient::Update (this=this@entry=0x7fffdbe1a010) at /TClient/src/engine/client/client.h:286
#7  0x00005555558da239 in CClient::Run (this=this@entry=0x7fffdbe1a010) at /TClient/src/engine/client/client.cpp:3449
#8  0x00005555558deb51 in main (argc=<optimized out>, argv=<optimized out>) at /TClient/src/engine/client/client.cpp:5281
print {m_TuneZone, m_TuneZoneOverride}
{21845, 1507524871}
// different crash
print {m_TuneZone, m_TuneZoneOverride}
{-1594056603, 605847552}

in game/client/prediction/entities/character.cpp
CCharacter::Read() which is called at the end of CCharacter::CCharacter()
on (vanilla) servers which don't send extended data
take the else path (pExtended == nullptr)
m_TuneZone and m_TuneZoneOverride are uninitialized when used in GetTuning(GetOverriddenTuneZone())
initialized after with m_TuneZoneOverride = TuneZone::OVERRIDE_NONE and SetTuneZone(...)

currently bandaid patched with ebf3239

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions