Bug #2451
opendai_unit_attack() dereferences a stale bodyguard pointer after the attack
0%
Description
dai_unit_attack() reads the attacker's bodyguard with aiguard_guard_of() before unit_do_action(), and dereferences the pointer afterwards, checking only that the attacker itself survived. However, the action can remove the bodyguard too in civil war. The server then segfaults at the def_ai_unit_data(bodyguard) read.
Patch stores the bodyguard ID and looks up by ID after action, since that's safe.
Files
Updated by Marko Lindqvist about 19 hours ago
- Target version set to 3.2.8
Patch does not apply to stable branches (S3_3 & S3_2). For S3_2 version you also need to use "NULL" instead of "nullptr"
Updated by Sweet Tea Dorminy about 15 hours ago
- File 0001-ai-default-Look-the-bodyguard-up-again-after-da-S3_2.patch 0001-ai-default-Look-the-bodyguard-up-again-after-da-S3_2.patch added
- File 0001-ai-default-Look-the-bodyguard-up-again-after-da-S3_3.patch 0001-ai-default-Look-the-bodyguard-up-again-after-da-S3_3.patch added
Here are some 3_2, 3_3 patches (with See RM #2451 in them)
Updated by Marko Lindqvist about 12 hours ago
Sweet Tea Dorminy wrote:
the action can remove the bodyguard too in civil war. The server then segfaults at the def_ai_unit_data(bodyguard) read.
I'm not against the patch that makes things more robust, but I fail to see how the described scenario could actually happen. You can't be allied with the player whose capital you conquer, so there can't be your bodyguard and their units on the same stack to begin with.
Updated by Marko Lindqvist about 12 hours ago
- Status changed from New to In Review
- Assignee set to Marko Lindqvist