-
Notifications
You must be signed in to change notification settings - Fork 117
[ZH] Fix game crash in MissileLauncherBuildingUpdate::initiateIntentToDoSpecialPower() #1218
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
xezon
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Zero Hour version looks ok.
GeneralsMD/Code/GameEngine/Source/GameLogic/Object/SpecialPower/SpecialPowerModule.cpp
Outdated
Show resolved
Hide resolved
I still need to check on the generals side, the code is quite different so might not have the same issues. |
a8e4f98 to
c791c49
Compare
|
Updated to add debug assert crash if we end up in the escape path and valid is set true. |
|
So i checked generals and it appears that the crash does not occur there but the exploit is there. I tested by just copying across the changes from the zero hour code and it allowed preventing the exploit, but it would also end up causing a mismatch. What are thoughts on this? i would say let the game mismatch if someone took advantage of this exploit since it's equivalent to the scud bug in a way. |
|
I suggest no mismatch. Can put fix behind !RETAIL_COMPATIBLE_CRC |
Then i will put the fix behind the retail compatible CRC and leave the exploit in place. |
…oDoSpecialPower()
c791c49 to
c823dde
Compare
|
Updated and added the exploit fix behind the retail compatible crc for generals. So this should be good to go now. |
|
Maybe we put the Generals change in a separate Pull Request then? Because it will then get the "NoRetail" label. Whereas Zero Hour fix is retail compatible. Edit: On second look, seems fine. Just need to be careful then when writing change log. |
Just as i was making the seperate PR too lol. i will hold back on that then. |
…tentToDoSpecialPower() (TheSuperHackers#1218)
This fixes a crash due to the nuke launcher not having its special power module loaded till it is fully constructed.
This was possibly intentional due to reasons described further on. The hack could have been avoided in other ways if the returns from quite a few functions were used and checked properly, but the hack i put in place is the only way to keep retail compatibility for now while preventing the crash.
The crash occurs within MissileLauncherBuildingUpdate::initiateIntentToDoSpecialPower() when attempting to retrieve the special power template from the special power module.
The issue occurs due to special power timers being initialised to zero instead of max uint. This is relevant as special power timers are set into the future for when the special power is ready based on the current frame.
The game then counts down to the future
m_availableOnFramevalue, where it then considers the special power available. By it being set to zero it can allow activation before it is meant to be usable.The full fix for this is setting the special power ready frame to be initialised to max uint, this prevents the messages activating the special power from being sent long before the point of the crash.
But
m_availableOnFrameis part of the CRC check, so i had to instead catch the crash point and set the ready frame into the future and then add some code to escape the activation of the power.In this instance the full escape is required as fixing the crash introduced an exploit where the power will immediately activate.
I won't post the reproduction steps here due to the nature of this bug.
Talk to me outside of this PR to learn the reproduction steps.
EDIT:
This PR also adds the special power timers exploit fix to generals behind a retail compatible CRC conditional.
TODO