UFO: Alien Invasion Issue Tracker
UFO: Alien Invasion
Go to the previous open issue
Go to the previous issue (open or closed)
star_faded.png
Please log in to bookmark issues
icon_project.png UFO: Alien Invasion / Closed Submit Patch #4558 segfault - dangling pointer deref
Go to the next issue (open or closed)
Go to the next open issue
This issue has been closed with status "Closed" and resolution "Not determined".
Issue basics
  • Type of issue
    Submit Patch
  • Category
    General
  • Targetted for
    Not determined
  • Status
    Closed
  • Priority
    3. Normal
User pain
  • Type of bug
    Not triaged
  • Likelihood
    Not triaged
  • Effect
    Not triaged
Affected by this issue (0)
There are no items
People involved
Times and dates
  • Posted at
  • Last updated
Issue details
Attachments (0)
There is nothing attached to this issue
Duplicate issues (0)
This issue does not have any duplicates
Description
[http://sourceforge.net/p/ufoai/patches/431 Item 431] imported from sourceforge.net tracker on 2013-01-28 20:39:33

To replicate the crash, connect and disconnect a few times repeatedly in the lobby.
The offending memory access happens on the irc_stream struct in cl_irc.c. The Irc_Net_Disconnect function calls NET_StreamFree which might free the memory of the stream struct. However, the global irc_stream pointer keeps pointing to the same (freed) memory. The next time the connect function is called, it checks irc_stream for NULL, and if not, it calls NET_StreamFree again on it. That might cause a segfault if the memory was actually freed during the first call. It might not, because NET_StreamFree doesn't always free the stream (memory leak?), so you might need to repeat a few times to replicate the crash. The quick fix is to set the global irc_stream pointer to NULL after freeing the stream in Disconnect.
===== Comments Ported from Sourceforge =====

====== polyvios (2009-08-27 19:52:11) ======

diff from current revision 25872
====== tlh2000 (2009-08-28 13:27:41) ======

Applied to trunk - thanks
Todos (0 / 0)
Issue created
footer_logo.png The Bug Genie 4.3.1 | Support | Feedback spinning_16.gif