MantisBT - Zandronum
View Issue Details
0004042Zandronum[All Projects] Bugpublic2022-10-02 23:042024-01-01 01:09
WaTaKiD 
Kaminsky 
normalcrashalways
resolvedfixed 
MicrosoftWindowsXP/Vista/7
3.1 
3.23.2 
0004042: server crash when a custom team wins via points
'https://euroboros.net/zandronum/download.php?file=tsb_inhumanmonstrosityv0.31.pk3 [^]'

this mod crashes servers when the "monstrosities" team wins via collecting souls from fragged "inhuman" team players
host a server with the mentioned wad with team deathmatch on map IMM01 with a pointlimit of 1
connect 2 clients, have em join different teams
take the monstrosity player and kill the inhuman player
a green floating orb will drop, go to it and press use
server crash
crash happens in both zan 3.1 and 3.2
windows and linux
no crash report is generated, even in 32 bit
only the mod's custom maps IMM01-IMM05 crash
while nothing of value shows up in a windows server log, the tspg linux log showed this: [22-10-02 15:39:39] *** buffer overflow detected ***: terminated
No tags attached.
Issue History
2022-10-02 23:04WaTaKiDNew Issue
2022-10-02 23:07WaTaKiDAdditional Information Updatedbug_revision_view_page.php?rev_id=13739#r13739
2022-10-02 23:09WaTaKiDAdditional Information Updatedbug_revision_view_page.php?rev_id=13740#r13740
2022-10-03 00:50KaminskyAssigned To => Kaminsky
2022-10-03 00:50KaminskyStatusnew => confirmed
2022-10-03 00:54KaminskyNote Added: 0022430
2022-11-13 21:40WaTaKiDTarget Version => 3.2
2023-03-22 04:38KaminskyNote Added: 0022818
2023-03-22 04:38KaminskyStatusconfirmed => needs testing
2024-01-01 01:08Ru5tK1ngNote Added: 0022945
2024-01-01 01:09Ru5tK1ngStatusneeds testing => resolved
2024-01-01 01:09Ru5tK1ngResolutionopen => fixed
2024-01-01 01:09Ru5tK1ngFixed in Version => 3.2

Notes
(0022430)
Kaminsky   
2022-10-03 00:54   
For the record, the crash occurs in TEAM_DoWinSequence in team.cpp:

char szString[32];
DHUDMessageFadeOut *pMsg;

// Display "%s WINS!" HUD message.
if ( ulTeamIdx < teams.Size( ) )
    sprintf( szString, "\\c%s%s WINS!", TEAM_GetTextColorName( ulTeamIdx ), TEAM_GetName( ulTeamIdx ));
else
    sprintf( szString, "DRAW GAME!\n" );

A string like "\x1c[Blue]Monstrosities united WINS!" can't fit completely in a char array with only 32 elements.
(0022818)
Kaminsky   
2023-03-22 04:38   
This particular issue should've been fixed now with:'http://hg.osdn.net/view/zandronum/zandronum-stable/rev/cca76668e470 [^]'
(0022945)
Ru5tK1ng   
2024-01-01 01:08   
Tested with r231220 and was unable to invoke a crash when following the outlined instructions with provided pk3.