Bug #2366
openToo long path by holding "g" causes game to crash
0%
Description
Predetermining a path for a unit by holding "g", one can crash the game by creating a really long path such as in the image.
This happened consistently using:
Windows 11 Pro 10.0.26200
gtk4 (gtk 4.14.4, glib 2.80.4)
version 3.2.6
Files
Updated by Eelis Vuokko 2 days ago
I tested it some more and it seems to happen only when moving the mouse outside of the map view and back again quickly while holding down g.
Updated by Marko Lindqvist 2 days ago
Eelis Vuokko wrote in #note-2:
it seems to happen only when moving the mouse outside of the map view and back again quickly while holding down g.
Thanks. Now I got "1: in send_packet_unit_orders_100() [packets_gen.c::36760]: assertion '!d_out.too_short' failed." on the client side, and a server crash.
Updated by Marko Lindqvist 2 days ago
And also some client crashes
Thread 1 "freeciv-gtk4" received signal SIGSEGV, Segmentation fault.
pf_path_last_position (path=0x0) at ../../src/common/aicore/path_finding.c:3535
3535 return path->positions + (path->length - 1);
(gdb) bt
#0 pf_path_last_position (path=0x0) at ../../src/common/aicore/path_finding.c:3535
#1 0x0000555555612909 in goto_get_turns (min=min@entry=0x7fffffffc400, max=max@entry=0x7fffffffc420)
at ../../src/client/goto.c:1133
#2 0x0000555555654277 in get_unit_info_label_text2 (punits=punits@entry=0x55555726c6a0, linebreaks=linebreaks@entry=0)
at ../../src/client/text.c:1155
#3 0x00005555555cce05 in update_unit_info_label (punits=0x55555726c6a0) at ../../src/client/gui-gtk-4.0/mapview.c:286
#4 0x00005555555cc67b in leave_mapcanvas (controller=<optimized out>, data=<optimized out>)
at ../../src/client/gui-gtk-4.0/mapctrl.c:457Updated by Marko Lindqvist 2 days ago
Updated by Marko Lindqvist 2 days ago
- File 0085-Stop-attempts-to-send-too-long-goto-routes-to-the-se.patch 0085-Stop-attempts-to-send-too-long-goto-routes-to-the-se.patch added
- Category set to General
- Status changed from New to In Review
- Assignee set to Marko Lindqvist
- Priority changed from Low to Normal
- Target version set to 3.2.7
There's at least two bugs in there, likely more. Let's reserve this ticket for the one that client tries to send overlong goto routes to the server, resulting in connection loss.
I'll open a new ticket for the client crash when the cursor leaves map view while goto is active, and other bugs as I identify them.
Updated by Marko Lindqvist 1 day ago
- Status changed from In Review to In Progress
Marko Lindqvist wrote in #note-6:
Let's reserve this ticket for the one that client tries to send overlong goto routes to the server, resulting in connection loss.
Current patch results MAX_LEN_ROUTE having different width on different operating systems, depending on the width of the size_t / sizeof(). That in turn leads to incompatible format characters in printf() formats.
Updated by Marko Lindqvist 1 day ago
- File 0026-Stop-attempts-to-send-too-long-goto-routes-to-the-se.patch 0026-Stop-attempts-to-send-too-long-goto-routes-to-the-se.patch added
- Status changed from In Progress to In Review
Marko Lindqvist wrote in #note-7:
Marko Lindqvist wrote in #note-6:
Let's reserve this ticket for the one that client tries to send overlong goto routes to the server, resulting in connection loss.
Current patch results MAX_LEN_ROUTE having different width on different operating systems, depending on the width of the size_t / sizeof(). That in turn leads to incompatible format characters in printf() formats.
Fixed