FS#138 - Crash when starting game using some GRF files.

Attached to Project: OpenTTD
Opened by Martin (mart3p) - Tuesday, 25 April 2006, 17:08 GMT
Last edited by Darkvater (Darkvater) - Tuesday, 25 April 2006, 17:42 GMT
Type Bug
Category NewGRF
Status Closed
Assigned To Peter Nelson (peter1138)
Operating System All
Severity Medium
Priority Normal
Reported Version trunk
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No


I have been experiencing a random crash when using pb_ukrs.grf.

This problem was introduced in r4537 in newrgf.c. In the process of replacing the "if" cascade with a switch block in the sprite group loader, a buffer length check was removed.

A varaction 2 type 85 or 86 (doubleword type) will fall through the switch block to the default case (for loading normal (non-varaction) action 2s).

A type 85, for example, will then be processed as if it had 0x85 loaded states, so data is read from past the end of the buffer. This sometimes causes an immediate crash but more often will crash when a game is started.

The patch re-adds a length check. It also adds a case, to explicitly test for types 85, 86, 89 and 8A, and give a suitable debug message.
This task depends upon

Closed by  Peter Nelson (peter1138)
Thursday, 27 April 2006, 06:59 GMT
Reason for closing:  Fixed
Additional comments about closing:  Ongoing work, this particular problem has been fixed now...