Bug #2366
open
Too long path by holding "g" causes game to crash
Added by Eelis Vuokko 3 days ago.
Updated about 9 hours ago.
Description
Predetermining a path for a unit by holding "g", one can crash the game by creating a really long path such as in the image.
This happened consistently using:
Windows 11 Pro 10.0.26200
gtk4 (gtk 4.14.4, glib 2.80.4)
version 3.2.6
Files
Couldn't trivially reproduce on linux.
I tested it some more and it seems to happen only when moving the mouse outside of the map view and back again quickly while holding down g.
Eelis Vuokko wrote in #note-2:
it seems to happen only when moving the mouse outside of the map view and back again quickly while holding down g.
Thanks. Now I got "1: in send_packet_unit_orders_100() [packets_gen.c::36760]: assertion '!d_out.too_short' failed." on the client side, and a server crash.
And also some client crashes
Thread 1 "freeciv-gtk4" received signal SIGSEGV, Segmentation fault.
pf_path_last_position (path=0x0) at ../../src/common/aicore/path_finding.c:3535
3535 return path->positions + (path->length - 1);
(gdb) bt
#0 pf_path_last_position (path=0x0) at ../../src/common/aicore/path_finding.c:3535
#1 0x0000555555612909 in goto_get_turns (min=min@entry=0x7fffffffc400, max=max@entry=0x7fffffffc420)
at ../../src/client/goto.c:1133
#2 0x0000555555654277 in get_unit_info_label_text2 (punits=punits@entry=0x55555726c6a0, linebreaks=linebreaks@entry=0)
at ../../src/client/text.c:1155
#3 0x00005555555cce05 in update_unit_info_label (punits=0x55555726c6a0) at ../../src/client/gui-gtk-4.0/mapview.c:286
#4 0x00005555555cc67b in leave_mapcanvas (controller=<optimized out>, data=<optimized out>)
at ../../src/client/gui-gtk-4.0/mapctrl.c:457
Marko Lindqvist wrote in #note-3:
Eelis Vuokko wrote in #note-2:
it seems to happen only when moving the mouse outside of the map view and back again quickly while holding down g.
and a server crash.
Correction: It was not a server crash, but the client lost the connection on its own.
There's at least two bugs in there, likely more. Let's reserve this ticket for the one that client tries to send overlong goto routes to the server, resulting in connection loss.
I'll open a new ticket for the client crash when the cursor leaves map view while goto is active, and other bugs as I identify them.
- Status changed from In Review to In Progress
Marko Lindqvist wrote in #note-6:
Let's reserve this ticket for the one that client tries to send overlong goto routes to the server, resulting in connection loss.
Current patch results MAX_LEN_ROUTE having different width on different operating systems, depending on the width of the size_t / sizeof(). That in turn leads to incompatible format characters in printf() formats.
Marko Lindqvist wrote in #note-7:
Marko Lindqvist wrote in #note-6:
Let's reserve this ticket for the one that client tries to send overlong goto routes to the server, resulting in connection loss.
Current patch results MAX_LEN_ROUTE having different width on different operating systems, depending on the width of the size_t / sizeof(). That in turn leads to incompatible format characters in printf() formats.
Fixed
Marko Lindqvist wrote in #note-6:
I'll open a new ticket for the client crash when the cursor leaves map view while goto is active
-> #2368
Marko Lindqvist wrote in #note-6:
I'll open a new ticket ... and other bugs as I identify them.
-> #2369
Also available in: Atom
PDF