Bug #2451
open
dai_unit_attack() dereferences a stale bodyguard pointer after the attack
Added by Sweet Tea Dorminy about 19 hours ago.
Updated about 12 hours ago.
Description
dai_unit_attack() reads the attacker's bodyguard with aiguard_guard_of() before unit_do_action(), and dereferences the pointer afterwards, checking only that the attacker itself survived. However, the action can remove the bodyguard too in civil war. The server then segfaults at the def_ai_unit_data(bodyguard) read.
Patch stores the bodyguard ID and looks up by ID after action, since that's safe.
Files
- Target version set to 3.2.8
Patch does not apply to stable branches (S3_3 & S3_2). For S3_2 version you also need to use "NULL" instead of "nullptr"
Here are some 3_2, 3_3 patches (with See RM #2451 in them)
Sweet Tea Dorminy wrote:
the action can remove the bodyguard too in civil war. The server then segfaults at the def_ai_unit_data(bodyguard) read.
I'm not against the patch that makes things more robust, but I fail to see how the described scenario could actually happen. You can't be allied with the player whose capital you conquer, so there can't be your bodyguard and their units on the same stack to begin with.
- Status changed from New to In Review
- Assignee set to Marko Lindqvist
Also available in: Atom
PDF