TFlippy / kag_territorycontrol

King Arthur's Gold - Territory Control Mod
https://forum.thd.vg/threads/territory-control-official-forum-badgers.26614/
18 stars 26 forks source link

Wood Logs bug #260

Open Mehbro opened 3 years ago

Mehbro commented 3 years ago

There's a bug with wood logs in which sometimes when i cut up a log for wood it generates an absurd amount of wood (20000+) which lags the server and gives a very OP advantage.

Hobey commented 3 years ago

If I understand the code correctly, the bug is caused by MinableMats.as onHit getting called before Log.as onInit, which happens only if a player or dynamite hit a minable blob in the first tick after it gets created, resulting in this.get("minableMats", @mats); returning a null pointer. That pointer is not null checked but instead gets interpreted by the code as a HarvestBlobMat struct, which should almost never result in a valid f32 amount and string matname, but when it does, it can end up spitting out a huge quantity of mats.

Could add if (mats is null) return; after line 35 in MinableMats.as onHit as an ad-hoc way of fixing the bug.

Also note that someone told me ingame that they experienced the bug with a ladder as well (instead of a log).

Edit: I just remembered that if a null pointer gets dereferenced in a script, the script just halts.

So probably the actual cause of the bug is HarvestBlobMat[]@ mats; in MinableMats.as onHit not setting an initial value of the mats pointer, and this.get("minableMats", @mats); not modifying the mats pointer out-parameter, since the "minableMats" property does not exist yet. That results in the mats pointer just being arbitrary uninitted stack memory probably, which ends up getting interpreted as a HarvestBlobMat pointer.

So, additionally to if (mats is null) return; after line 35, also change line 34 to HarvestBlobMat[]@ mats = null;, or, alternatively just do a if (!this.exists("minableMats")) return;.

Dunno what a good way of reproducing the bug would be since it's so rare.