dethrace-labs / dethrace

Reverse engineering the 1997 game "Carmageddon"
https://twitter.com/dethrace_labs
GNU General Public License v3.0
669 stars 38 forks source link

Fix damaged cars in action replay #333

Closed madebr closed 1 year ago

madebr commented 1 year ago

This fixes buffer a overflow in action replay, when the car has been damaged. It also fixes a bonus overflow (catched with asan), + more debug checks for piping. Because replay behaves more stable and much faster, the patch removes the --enable-replay option to enable replay. It is now always available.

The header of a session {type: u8, count: u8}. The number of chunks in a session was read wrong, most often it was 0xff on my system because heap pointers on my system (=Linux) look like 0x7ffff3aec800. Perhaps malloc behaves different on other platform because not everybody was seeing these crashes. It fixes slow seeking in replay, and explains broken models. This bug caused all deltas to be undone 255 times instead of 1 time. It looks like only geometry and "hp" damage are stored as deltas in the pipe, so those were undone 254 times too often.