search

elunna / hackem

SlashEM forked Unto Evil with a Splice of X and a dash of THEM.
Other
23 stars 8 forks source link

Found with fuzzer: del_light_source: not found type=1, #19

Closed elunna closed 1 year ago

elunna commented 1 year ago 

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50  ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff7365859 in __GI_abort () at abort.c:79
#2  0x0000555555a429c5 in NH_abort () at end.c:236
#3  0x0000555555a497c1 in panic (str=0x55555651cb00 "%s") at end.c:802
#4  0x0000555555f97813 in impossible (
    s=0x5555564b0d80 "del_light_source: not found type=%d, id=%s") at pline.c:518
#5  0x0000555555b127b6 in del_light_source (type=1, id=0x5555567c54e0 <tmp_anything>)
    at light.c:133
#6  0x0000555555fa745f in rehumanize () at polyself.c:1275
#7  0x0000555555cd7789 in mdamageu (mtmp=0x61100097ea40, n=16) at mhitu.c:3929
#8  0x0000555555cba3e0 in hitmu (mtmp=0x61100097ea40, mattk=0x5555565f6d08 <mons+7400>)
    at mhitu.c:2718
#9  0x0000555555ca1f75 in mattacku (mtmp=0x61100097ea40) at mhitu.c:1012
#10 0x0000555555e37185 in dochug (mtmp=0x61100097ea40) at monmove.c:964
#11 0x0000555555e225f5 in dochugw (mtmp=0x61100097ea40) at monmove.c:122
#12 0x0000555555d91dcf in movemon () at mon.c:1514
#13 0x000055555575c28a in moveloop (resuming=0 '\000') at allmain.c:244
#14 0x00005555563b536a in main (argc=0, argv=0x7fffffffe648) at ../sys/unix/unixmain.c:353
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
        set = {__val = {0, 0, 0, 0, 0, 140737337632192, 93824997402263, 335544320, 
            140737341055120, 1073741824, 0, 140737342801568, 4294967295, 140737337360384, 
            140737342784672, 15670973505660846336}}
        pid = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
#1  0x00007ffff7365859 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0xffffffff, sa_sigaction = 0xffffffff}, 
          sa_mask = {__val = {140737337360384, 140737342784672, 15670973505660846336, 
              140737488342352, 140737342801568, 18446744073709547520, 140737327112192, 
              140737345470680, 140737488343424, 140737488343424, 140737344339986, 
              17592186042794, 140737488334848, 140737341055120, 15670973505660846336, 
              140737488342752}}, sa_flags = 24707328, sa_restorer = 0x7fffffffd0a0}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x0000555555a429c5 in NH_abort () at end.c:236
        gdb_prio = 1
        libc_prio = 2
        aborting = 1 '\001'
#3  0x0000555555a497c1 in panic (str=0x55555651cb00 "%s") at end.c:802
        the_args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fffffffd170, 
            reg_save_area = 0x7fffffffd0a0}}
#4  0x0000555555f97813 in impossible (
    s=0x5555564b0d80 "del_light_source: not found type=%d, id=%s") at pline.c:518
        pbuf = "del_light_source: not found type=1, id=5555567ba6a0\000\377\377\377\377\214\236b\367\377\177\000\000\020\001\000\000\320`\000\000\000\001y\001`{zـ\322\377\377\377\177\000\000@\352\227\000\020a\000\000@\330\377\377\377\177\000\000\\\372\377\377\377\017\000\000\340\322\377\377\377\177\000\000\000\001y\001`{z\331p\330\377\377\377\177\000\000@\352\227\000\020a\000\000p\330\377\377\377\177\000\000b\372\377\377\377\017\000\000\020\323\377\377\377\177\000\000\060\332\377\377\377\177\000\000\240\330\377\377\377\177\000\000\315A\223UUU\000\000\020\323\377\377\377\177\000\000p"...
        the_args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7fffffffd860, 
            reg_save_area = 0x7fffffffd780}}
#5  0x0000555555b127b6 in del_light_source (type=1, id=0x5555567c54e0 <tmp_anything>)
    at light.c:133
        curr = 0x0
        prev = 0x0
        next = 0x0
        tmp_id = {a_void = 0x0, a_obj = 0x0, a_monst = 0x0, a_int = 0, a_char = 0 '\000', 
          a_schar = 0 '\000', a_uchar = 0 '\000', a_uint = 0, a_long = 0, a_ulong = 0, 
          a_iptr = 0x0, a_lptr = 0x0, a_ulptr = 0x0, a_uptr = 0x0, a_string = 0x0, 
          a_nfunc = 0x0, a_mask32 = 0}
        found_it = 0 '\000'
#6  0x0000555555fa745f in rehumanize () at polyself.c:1275
        was_flying = 1 '\001'
#7  0x0000555555cd7789 in mdamageu (mtmp=0x61100097ea40, n=16) at mhitu.c:3929
No locals.
#8  0x0000555555cba3e0 in hitmu (mtmp=0x61100097ea40, mattk=0x5555565f6d08 <mons+7400>)
    at mhitu.c:2718
        mdat = 0x5555565f6cf8 <mons+7384>
        uncancelled = 1
        ptmp = 21845
        dmg = 16
        armpro = 0
        permdmg = 0
        tmphp = 0
        buf = "\360\333\377\377\377\177\000\000n\036\346UUU\000\000\377\017\000\000\000\000\000\000\000\333\377\377\377\177\000\000p\333\377\377\377\177\000\000@\352\227\000\020a\000\000\375\377\377\377\377\177\000\000\340\332\377\000\003\000\000\000\377\377\377\377\a\000\000\000\006", '\000' <repeats 11 times>, "\001", '\000' <repeats 20 times>, "\344\227\000\020a\000\000\263\212\265A\000\000\000\000@`NVUU\000\000\306\021\346UUU\000\000\360\333\377\377\377\177\000\000\000\000\000\000\001\000\000\000\001\000\000\000\001\000\000\000\000\000\000\000", '\377' <repeats 12 times>, "\000\000\000\000\a\000\000\000\000g\223\000\300`\000\000px|VUU\000\000"...
        olduasmon = 0x5555565fedc0 <mons+40352>
        res = 1
        burnmsg = 0 '\000'
        armask = 0
        hated_obj = 0x0
        vorpal_wield = 0 '\000'
#9  0x0000555555ca1f75 in mattacku (mtmp=0x61100097ea40) at mhitu.c:1012
        mattk = 0x5555565f6d08 <mons+7400>
        alt_attk = {aatyp = 0 '\000', adtyp = 0 '\000', damn = 0 '\000', damd = 0 '\000'}
        i = 0
        j = 10
        k = 0
        tmp = 25
        sum = {0, 1, 0, 0, 1, 0}
        mdat = 0x5555565f6cf8 <mons+7384>
        marmf = 0x0
        ranged = 0 '\000'
        range2 = 0 '\000'
        foundyou = 1 '\001'
        youseeit = 0 '\000'
        skipnonmagc = 0 '\000'
#10 0x0000555555e37185 in dochug (mtmp=0x61100097ea40) at monmove.c:964
        mdat = 0x5555565f6cf8 <mons+7384>
        tmp = <optimized out>
        mdummy = 0x0
        inrange = 1
        nearby = 1
        scared = 0
        oldx = 21845
        oldy = 1451019490
        mwalk_sewage = 0 '\000'
#11 0x0000555555e225f5 in dochugw (mtmp=0x61100097ea40) at monmove.c:122
        x = 5
        y = 4
        already_saw_mon = 0 '\000'
        rd = 300
#12 0x0000555555d91dcf in movemon () at mon.c:1514
        mtmp = 0x61100097ea40
        nmtmp = 0x61100097eb80
        somebody_can_move = 0 '\000'
#13 0x000055555575c28a in moveloop (resuming=0 '\000') at allmain.c:244
        moveamt = 12
        wtcap = 0
        change = 0
        monscanmove = 1 '\001'
        timeout_start = 32018
        past_clock = 6785
        elf_regen = 1 '\001'
        orc_regen = 1 '\001'
        vamp_regen = 1 '\001'
#14 0x00005555563b536a in main (argc=0, argv=0x7fffffffe648) at ../sys/unix/unixmain.c:353
        fd = -1
        dir = 0x0
        exact_username = 0 '\000'
        resuming = 0 '\000'
        plsel_once = 1 '\001'
elunna commented 1 year ago

Might be due to being a monster that emits light:

if (emits_light(youmonst.data)) del_light_source(LS_MONSTER, monst_to_any(&youmonst));

define emits_light(ptr) \

(((ptr)->mlet == S_LIGHT \
 || (ptr) == &mons[PM_FLAMING_SPHERE] \
 || (ptr) == &mons[PM_LAVA_BLOB] \
 || (ptr) == &mons[PM_SHOCKING_SPHERE] \
 || (ptr) == &mons[PM_BABY_GOLD_DRAGON] \
 || (ptr) == &mons[PM_WAX_GOLEM]      \
 || (ptr) == &mons[PM_BLAZING_FERN] \
 || (ptr) == &mons[PM_BLAZING_FERN_SPROUT] \
 || (ptr) == &mons[PM_BLAZING_FERN_SPORE] \
 || (ptr) == &mons[PM_FIRE_VORTEX]) \
     ? 1 \
     : ((ptr) == &mons[PM_FIRE_ELEMENTAL] \
        || (ptr) == &mons[PM_FIRE_VAMPIRE] \
        || (ptr) == &mons[PM_GOLD_DRAGON] \
        || (ptr) == &mons[PM_TIAMAT]) ? 2 : 0)

We can't polymorph into ferns, Tiamat...

Could not reproduce the crash by polying into any of the above and dying.

elunna commented 1 year ago

Popped up again. A little different:

Suddenly, the dungeon collapses.
del_light_source: not found type=1, id=5555567e3660
Generating more information you may report:

[0] /lib/x86_64-linux-gnu/libasan.so.5(+0x6cd40) [0x7ffff75f8d40]
[1] /home/lunatunez/games/hackemdir/hackem(+0x4fbb47) [0x555555a4fb47]
[2] /home/lunatunez/games/hackemdir/hackem(+0x4fba3a) [0x555555a4fa3a]
[3] /home/lunatunez/games/hackemdir/hackem(panic+0x6ab) [0x555555a5685c]
[4] /home/lunatunez/games/hackemdir/hackem(impossible+0x2c8) [0x555555faf01a]
[5] /home/lunatunez/games/hackemdir/hackem(del_light_source+0x46a) [0x555555b24806]
[6] /home/lunatunez/games/hackemdir/hackem(rehumanize+0x5be) [0x555555fbec80]
[7] /home/lunatunez/games/hackemdir/hackem(+0xacaf89) [0x55555601ef89]
[8] /home/lunatunez/games/hackemdir/hackem(+0xad38d3) [0x5555560278d3]
[9] /home/lunatunez/games/hackemdir/hackem(+0xaea4fd) [0x55555603e4fd]
[10] /home/lunatunez/games/hackemdir/hackem(unmul+0x3d3) [0x555555af17cc]
[11] /home/lunatunez/games/hackemdir/hackem(moveloop+0x3bb0) [0x5555557657d6]
[12] /home/lunatunez/games/hackemdir/hackem(main+0xdda) [0x5555563dda8f]
[13] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x7ffff7365083]
[14] /home/lunatunez/games/hackemdir/hackem(_start+0x2e) [0x55555575face]

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50  ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff7363859 in __GI_abort () at abort.c:79
#2  0x0000555555a4fa60 in NH_abort () at end.c:236
#3  0x0000555555a5685c in panic (str=0x555556548e20 "%s") at end.c:802
#4  0x0000555555faf01a in impossible (
    s=0x5555564dbb60 "del_light_source: not found type=%d, id=%s") at pline.c:518
#5  0x0000555555b24806 in del_light_source (type=1, id=0x5555567ee580 <tmp_anything>)
    at light.c:133
#6  0x0000555555fbec80 in rehumanize () at polyself.c:1275
#7  0x000055555601ef89 in fix_worst_trouble (trouble=2) at pray.c:489
#8  0x00005555560278d3 in pleased (g_align=1 '\001') at pray.c:1156
#9  0x000055555603e4fd in prayer_done () at pray.c:2862
#10 0x0000555555af17cc in unmul (msg_override=0x0) at hack.c:3469
#11 0x00005555557657d6 in moveloop (resuming=0 '\000') at allmain.c:610
#12 0x00005555563dda8f in main (argc=0, argv=0x7fffffffe628) at ../sys/unix/unixmain.c:353
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
        set = {__val = {0, 0, 0, 0, 0, 140737335783280, 93824997455666, 335544320, 
            140737341046928, 1073741824, 0, 140737342793376, 4294967295, 140737337360384, 
            140737342776480, 16073220022468137216}}
        pid = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
#1  0x00007ffff7363859 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0xffffffff, sa_sigaction = 0xffffffff}, 
          sa_mask = {__val = {140737337360384, 140737342776480, 16073220022468137216, 
              140737488344064, 140737342793376, 18446744073709547520, 140737327104000, 
              140737345462488, 140737488345136, 140737488345136, 140737344331794, 
              17592186043008, 140737488338944, 140737341046928, 16073220022468137216, 
              140737488344464}}, sa_flags = 1810419968, sa_restorer = 0x7fffffffd750}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x0000555555a4fa60 in NH_abort () at end.c:236
        gdb_prio = 1
        libc_prio = 2
        aborting = 1 '\001'
#3  0x0000555555a5685c in panic (str=0x555556548e20 "%s") at end.c:802
        the_args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fffffffd820, 
            reg_save_area = 0x7fffffffd750}}
#4  0x0000555555faf01a in impossible (
    s=0x5555564dbb60 "del_light_source: not found type=%d, id=%s") at pline.c:518
        pbuf = "del_light_source: not found type=1, id=5555567e3660", '\000' <repeats 70 times>, "\321\350ks\214\017\337\000\000\000\000\000\000\000\000\037[>VUU\000\000`\332\377\377\377\177\000\000\252\226\177VUU\000\000P\331\377\377\377\177\000\000J[>VUU\000\000P\331\377\377\377\177\000\000\000f~VUU\000\000\200\331\377\377\377\177\000\000"...
        the_args = {{gp_offset = 24, fp_offset = 48, overflow_arg_area = 0x7fffffffdf10, 
            reg_save_area = 0x7fffffffde30}}
#5  0x0000555555b24806 in del_light_source (type=1, id=0x5555567ee580 <tmp_anything>)
    at light.c:133
        curr = 0x0
        prev = 0x0
        next = 0x200200
        tmp_id = {a_void = 0x0, a_obj = 0x0, a_monst = 0x0, a_int = 0, a_char = 0 '\000', 
          a_schar = 0 '\000', a_uchar = 0 '\000', a_uint = 0, a_long = 0, a_ulong = 0, 
          a_iptr = 0x0, a_lptr = 0x0, a_ulptr = 0x0, a_uptr = 0x0, a_string = 0x0, 
          a_nfunc = 0x0, a_mask32 = 0}
        found_it = 0 '\000'
#6  0x0000555555fbec80 in rehumanize () at polyself.c:1275
        was_flying = 1 '\001'
#7  0x000055555601ef89 in fix_worst_trouble (trouble=2) at pray.c:489
        i = 0
        otmp = 0x0
        what = 0x0
        leftglow = "Your left ring softly glows"
        rightglow = "Your right ring softly glows"
#8  0x00005555560278d3 in pleased (g_align=1 '\001') at pray.c:1156
        action = 2
        prayer_luck = 0
        tryct = 1
        trouble = 2
        pat_on_head = 0
        kick_on_butt = 0
#9  0x000055555603e4fd in prayer_done () at pray.c:2862
        alignment = 1 '\001'
#10 0x0000555555af17cc in unmul (msg_override=0x0) at hack.c:3469
        f = 0x55555603dacf <prayer_done>
#11 0x00005555557657d6 in moveloop (resuming=0 '\000') at allmain.c:610
        mtmp = 0x0
        moveamt = 9
        wtcap = 0
        change = 0
        monscanmove = 0 '\000'
        timeout_start = 31364
        past_clock = 95349
        elf_regen = 1 '\001'
        orc_regen = 1 '\001'
        vamp_regen = 1 '\001'
#12 0x00005555563dda8f in main (argc=0, argv=0x7fffffffe628) at ../sys/unix/unixmain.c:353
        fd = -1
        dir = 0x0
        exact_username = 0 '\000'
        resuming = 0 '\000'
        plsel_once = 1 '\001'
elunna commented 1 year ago

define LS_MONSTER 1

We already know this is a monster light source.

define PM_GOLD_DRAGON 380

Some ideas on what's happening here:

elunna commented 1 year ago

This also popped up with a Fire Elemental as the light source.

elunna commented 1 year ago

Also tested these. A shadow ogre/wolf or nabassu dimmed the gold dragon? Same effect as above. Polyd into a light emitter and get slimed. Dying as a gold dragon while wearing amulet of unchanging. Quaffing potion of amnesia while polyd into a gold dragon Getting hit/killed with wand of water? Tested as a fire elemental

Baby gold dragon growing up into a gold dragon? - not possible while polyd?