UnderscoreKilburn / repentance-issues

Public bug tracker for the Binding of Isaac: Repentance
20 stars 4 forks source link

Lil Portal's Portal entity hash collision with Siren's Charm effect causing crashes #2119

Closed epfly6 closed 6 days ago

epfly6 commented 3 months ago

(Take some of my words with grain of salt)

The game is using entity configuration stored in hash table, with hash key for each entity entry stored as 32bit key, allocated with EntityType , EntityVariant and EntitySubtype (12bits, 12bits, 8 bits) (remembered from _Kilburn messages in Isaac discord server)

Lil Portal spawns a portal that contains a target room index for teleporting Isaac to a room with that id in the Subtype field (1000 + targetRoomIdx). Since subtype for ent configuration is stored in 8 bits, which maximum num allowed is 255, then the game can look at another entity's config instead of the portal's. Notable example when portal tries to spawn it's portal to map's grid positions 11x1 and 12x1 (24, 25 index)

Portal with id 1000.161.1024 collides with Siren's charm visual entity with id 1000.165.0 (Below you can see calculated results) image

,which causing the game load configuration (including sprite path) of charm effect to portal, and since update logic is run for portal, then the game tries to read and manipulate with invalid sprite data, which results in crashes!

Videoclip of that crash where it was firstly discovered: https://clips.twitch.tv/WanderingHappyWeaselRiPepperonis-zeQiJYlGqYjO4Jl2

epfly6 commented 6 days ago

Since item was reworked, I guess we can mark this issue as fixed?