OpenTTD

Tasklist

FS#1717 - Reallocation of sprite cache may lead to crash (fix included)

Attached to Project: OpenTTD
Opened by PhilSophus (PhilSophus) - Monday, 28 January 2008, 18:31 GMT
Type Bug
Category Core
Status Closed
Assigned To No-one
Operating System All
Severity Critical
Priority Normal
Reported Version trunk
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

In this topic, Swallow reported a crash during startup of OpenTTD: http://www.tt-forums.net/viewtopic.php?f=31&t=35984

I found out, that this is probably due to an error in DupSprite() in spritecache.cpp:
void DupSprite(SpriteID old_spr, SpriteID new_spr)
{
SpriteCache *scold = GetSpriteCache(old_spr);
SpriteCache *scnew = AllocateSpriteCache(new_spr);
...
}

The call to AllocateSpriteCache may reallocate the _spritecache array letting scold point to invalid memory. Swapping these two lines should solve the issue (see attached patch). This seems to be the only place in the code, that has this problem.
This task depends upon

Closed by  Remko Bijker (Rubidium)
Tuesday, 29 January 2008, 00:29 GMT
Reason for closing:  Fixed
Additional comments about closing:  In r12005.

Loading...