MantisBT - Zandronum
View Issue Details
0001475Zandronum[All Projects] Bugpublic2013-08-25 22:522018-09-30 23:04
anotak 
Torr Samaho 
normalcrashalways
closedfixed 
MicrosoftWindowsXP/Vista/7
1.1.1 
2.02.0 
0001475: buffer overflow when player dies while 2 wads loaded
I made akuma.wad and my friend said their game crashed during a survival coop session whenever anyone died trying to play it.

We tracked it down to only happening when both of these wads are loaded and the player dies, apparently even in singleplayer:
'http://www.doomworld.com/idgames/?id=16692 [^]'
'https://dl.dropboxusercontent.com/u/26808604/coopzomb2.wad [^]'
there is no problem when either one is individually loaded and we've played with coopzomb2 on a ton of wads with no problem. Akuma.wad contains no decorate and the only ACS changes the color of 2 sectors on ENTER.

The error message windows is giving is:

Problem signature:
  Problem Event Name: BEX
  Application Name: zandronum.exe
  Application Version: 0.98.21805.1
  Application Timestamp: 51e855a2
  Fault Module Name: zandronum.exe
  Fault Module Version: 0.98.21805.1
  Fault Module Timestamp: 51e855a2
  Exception Offset: 002b469b
  Exception Code: c000000d
  Exception Data: 00000000
  OS Version: 6.1.7601.2.1.0.256.1
  Locale ID: 1033
  Additional Information 1: f9f2
  Additional Information 2: f9f24b8033e98e8ea9683c234bd073d3
  Additional Information 3: afb9
  Additional Information 4: afb95e5f19c544fda4b12bf1684bbac0

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt
No tags attached.
7z coopzomb5wip7.wad.7z (1,855,744) 2015-01-15 11:37
/tracker/file_download.php?file_id=1377&type=bug
Issue History
2013-08-25 22:52anotakNew Issue
2013-08-26 17:03WatermelonNote Added: 0007068
2013-08-26 18:39anotakNote Added: 0007069
2013-08-26 18:40anotakNote Edited: 0007069bug_revision_view_page.php?bugnote_id=7069#r3964
2013-08-26 21:30WatermelonNote Added: 0007070
2013-08-26 22:32Edward-sanNote Added: 0007071
2013-08-27 03:29anotakNote Added: 0007072
2014-06-14 17:46WatermelonNote Added: 0009327
2014-06-14 17:46WatermelonStatusnew => feedback
2015-01-15 05:49GoboltNote Added: 0011376
2015-01-15 05:50GoboltNote Edited: 0011376bug_revision_view_page.php?bugnote_id=11376#r6389
2015-01-15 11:37DuskFile Added: coopzomb5wip7.wad.7z
2015-01-15 13:20Edward-sanNote Added: 0011377
2015-01-15 13:48Edward-sanNote Edited: 0011377bug_revision_view_page.php?bugnote_id=11377#r6391
2015-01-15 13:48Edward-sanAssigned To => Torr Samaho
2015-01-15 13:48Edward-sanStatusfeedback => assigned
2015-01-15 13:50Edward-sanNote Edited: 0011377bug_revision_view_page.php?bugnote_id=11377#r6392
2015-01-17 15:19cobaltStatusassigned => needs testing
2015-01-17 15:19cobaltTarget Version => 2.0
2015-01-17 15:19cobaltDescription Updatedbug_revision_view_page.php?rev_id=6425#r6425
2015-01-17 15:19cobaltNote Added: 0011408
2015-01-21 00:27WaTaKiDNote Added: 0011465
2015-02-21 13:02DuskStatusneeds testing => resolved
2015-02-21 13:02DuskFixed in Version => 2.0
2015-02-21 13:02DuskResolutionopen => fixed
2018-09-30 23:04Blzut3Statusresolved => closed

Notes
(0007068)
Watermelon   
2013-08-26 17:03   
Does it crash in zdoom if you try that online with your friend?
(0007069)
anotak   
2013-08-26 18:39   
(edited on: 2013-08-26 18:40)
no crashes in Zdoom offline, I'll have to ask him to try online when he's available

I'm not sure if coopzomb2.wad does anything in zdoom though? I'm not the author of that.

(0007070)
Watermelon   
2013-08-26 21:30   
It's just to confirm if it's a zdoom bug or not. If it doesn't happen on zdoom then we need to fix it.

If it happens on ZDoom then we need to have you file a bug report, and when they fix it, then we just pull the code in that they fixed it with.
(0007071)
Edward-san   
2013-08-26 22:32   
Does it happen with gzdoom 323?
(0007072)
anotak   
2013-08-27 03:29   
like i said, both wads crash in single player in zandronum, but not on zdoom. i just haven't had a chance to test in multiplayer because my friend has been busy. but it doesn't seem like a multiplayer problem, that was just where we first encountered it. i'll get him to try as soon as he can anyway.

gzdoom (i tried the one you linked) doesn't like coopzomb2.wad, crashes on startup. the error is:

Execution could not continue.

Script error, "coopzomb2.wad:DECORATE" line 305:
Invalid state parameter a_monsterrefire
(0009327)
Watermelon   
2014-06-14 17:46   
Still the same in 2.0?
(0011376)
Gobolt   
2015-01-15 05:49   
(edited on: 2015-01-15 05:50)
Still crashes in 2.0

I had forgotten coopzomb2 was linked here for that and took down the file after a while,'https://dl.dropboxusercontent.com/u/26808604/DOOM/coopzomb5wip7.wad [^]' so here is the latest working version of coopzomb. Crashes all the same.

For what it's worth, this bug seems to affect all maps made with the zdoom (doom in hexen format) setting in doombuilder, based on what someone else tested for me anyway, and they are slightly buggy in zdoom 2.7.1 as well, but in zdoom the spawned zombie simply despawns upon firing instead of crashing the entire program the moment it tries to spawn.

(0011377)
Edward-san   
2015-01-15 13:20   
(edited on: 2015-01-15 13:50)
I get a null pointer crash in both zandronum 1.x, zandronum 2.0 and gzdoom 900, doesn't happen in latest gzdoom. The crash happens while doing this code:


                STACK(1) = 0 == stricmp (FBehavior::StaticLookupString (STACK(1)),
                    activator->player->ReadyWeapon->GetClass()->TypeName.GetChars());


in p_acs.cpp line 6809. Investigating which revision fixed it.

[edit] it's fixed in zdoom r3107, which fixed this old bug.

[edit]while we're at it, there's a typo in [BB] comment: "CheckWeaponn"

(0011408)
cobalt   
2015-01-17 15:19   
Issue addressed by commit f3e54121: out of sequence fix backport from ZDoom revision 3107: - changed ACS Checkweapon to compare names instead of strings. This addresses 1475.
Committed by Benjamin Berkels [Torr Samaho] on Saturday 17 January 2015 15:24:36

Changes in files:
 src/p_acs.cpp | 25 ++++++++++++-------------
 1 files changed, 12 insertions(+), 13 deletions(-)
(0011465)
WaTaKiD   
2015-01-21 00:27   
after testing with 2.0-r150119-2001, the crash seems fixed