UFO: Alien Invasion Issue Tracker
UFO: Alien Invasion
Go to the previous open issue
Go to the previous issue (open or closed)
star_faded.png
Please log in to bookmark issues
icon_project.png UFO: Alien Invasion / Closed Submit Patch #4818 Fix testall crash - cvar developer use-after-free.
Go to the next issue (open or closed)
Go to the next open issue
This issue has been closed with status "Closed" and resolution "Not determined".
Issue basics
  • Type of issue
    Submit Patch
  • Category
    General
  • Targetted for
    Not determined
  • Status
    Closed
  • Priority
    1. Very low
User pain
  • Type of bug
    Not triaged
  • Likelihood
    Not triaged
  • Effect
    Not triaged
Affected by this issue (0)
There are no items
People involved
Times and dates
  • Posted at
  • Last updated
Issue details
Attachments (0)
There is nothing attached to this issue
Duplicate issues (0)
This issue does not have any duplicates
Description
[http://sourceforge.net/p/ufoai/patches/691 Item 691] imported from sourceforge.net tracker on 2013-01-28 20:46:59

This patch NULLs developer before Cvars and memory are destroyed. An example of what happens when it's not:

Variable cvar_t *developer in src/game/g_main starts off as NULL and several test suites never touch it. Then developer is set non-NULL by the routing test suite:
> testMoveEntities->SV_Map->SV_InitGame->SV_InitGameProgs->G_Init

At the end of the suite, Cvars are nuked by
> UFO_CleanSuiteRouting->TEST_Shutdown->Cvar_Shutdown

but developer still points to allocated memory until
> UFO_CleanSuiteRouting->TEST_Shutdown->Mem_Shutdown

When the Inventory suite runs, developer is checked for non-null and
dereferenced while printing a perfectly routine message at
> UFO_Init_SuiteInventory->TEST_Init->SV_Init->SV_MapcycleInit->SV_ParseMapcycle->SV_MapcycleAdd->Com_DBPrintf

but developer now points to an invalid non-NULL memory location and
so the program segfaults.
===== Comments Ported from Sourceforge =====

====== tlh2000 (2012-10-21 18:42:40.251000) ======

applied to master - thanks a lot
Todos (0 / 0)
Issue created
footer_logo.png The Bug Genie 4.3.1 | Support | Feedback spinning_16.gif