[Freeciv-Dev] (PR#13594) pubserver crash in send_info_to_onlookers

["Jason Short" <jdorje@xxxxxxxxxxxxxxxxxxxxx>]

<URL: http://bugs.freeciv.org/Ticket/Display.html?id=13594 >

Looks like this is just a NULL deference, though I don't know what 
triggers it.  Hopefully the attached patch handles the NULL case.

This bug should only affect 2.0.

-jason


-------- Original Message --------
From: - Tue Aug  2 20:16:52 2005
X-Account-Key: account1
X-UIDL: GmailId10579b07f14b9fef
X-Mozilla-Status: 0001
X-Mozilla-Status2: 10000000
X-Gmail-Received: 3ce322241b28db6e571e7cb26a6fe045332555a7
Delivered-To: jdorje@xxxxxxxxx
Received: by 10.54.4.39 with SMTP id 39cs38765wrd;        Tue, 2 Aug 
2005 17:14:34 -0700 (PDT)
Received: by 10.38.181.38 with SMTP id d38mr59938rnf;        Tue, 02 Aug 
2005 17:14:34 -0700 (PDT)
Return-Path: <freeciv-dev-bounce@xxxxxxxxxxx>
Received: from freeciv.freeciv.org (www.freeciv.org [207.158.49.130]) 
      by mx.gmail.com with ESMTP id j20si76238rnf.2005.08.02.17.14.31; 
       Tue, 02 Aug 2005 17:14:34 -0700 (PDT)
Received-SPF: pass (gmail.com: best guess record for domain of 
freeciv-dev-bounce@xxxxxxxxxxx designates 207.158.49.130 as permitted 
sender)
Received: from glockenspiel.complete.org (glockenspiel.complete.org 
[69.10.152.57]) by freeciv.freeciv.org (8.12.10/8.12.10) with ESMTP id 
j730ETxB012614; Tue, 2 Aug 2005 17:14:29 -0700
Received: from localhost ([127.0.0.1] helo=glockenspiel)        by 
glockenspiel.complete.org with esmtp    (Exim 4.50)     id 1E06sd-0002TL-3i; 
Tue, 02 Aug 2005 19:13:08 -0500
Received: with ECARTIS (v1.0.0; list freeciv-dev); Tue, 02 Aug 2005 
19:12:56 -0500 (CDT)
Received: from pubserver.freeciv.org ([207.158.49.131]) by 
glockenspiel.complete.org with esmtps   (with 
TLS-1.0:DHE_RSA_3DES_EDE_CBC_SHA:24)    (No TLS peer certificate)       (Exim 
4.50)   id 1E06sP-0002TE-AR     for freeciv-dev@xxxxxxxxxxx; Tue, 02 Aug 2005 
19:12:55 -0500
Received: from pubserver.freeciv.org (localhost.localdomain 
[127.0.0.1])    by pubserver.freeciv.org (8.12.8/8.12.8) with ESMTP id 
j730Ca2R008642  for <freeciv-dev@xxxxxxxxxxx>; Tue, 2 Aug 2005 17:12:36 -0700
Received: (from freeciv@localhost)      by pubserver.freeciv.org 
(8.12.8/8.12.8/Submit) id j730CZAs008640        for freeciv-dev@xxxxxxxxxxx; 
Tue, 2 Aug 2005 17:12:35 -0700
Date: Tue, 2 Aug 2005 17:12:35 -0700
From: freeciv@xxxxxxxxxxxxxxxxxxxxx
To: freeciv-dev@xxxxxxxxxxx
Subject: [Freeciv-Dev] civserver crashed: 
http://pubserver.freeciv.org/games/459283
Message-ID: <20050802171235.A8638@xxxxxxxxxxxxxxxxxxxxx>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="pWyiEgJYm5f9v55/"
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
X-Spam-Status: No (score 0.3): AWL=-0.104, NO_REAL_NAME=0.178, 
UPPERCASE_25_50=0.207
X-Virus-Scanned: by Exiscan on glockenspiel.complete.org at Tue, 02 Aug 
2005 19:12:55 -0500
X-archive-position: 1239
X-ecartis-version: Ecartis v1.0.0
Sender: freeciv-dev-bounce@xxxxxxxxxxx
Errors-to: freeciv-dev-bounce@xxxxxxxxxxx
X-original-sender: freeciv@xxxxxxxxxxxxxxxxxxxxx
Precedence: bulk
List-help: <mailto:ecartis@xxxxxxxxxxx?Subject=help>
List-unsubscribe: 
<mailto:freeciv-dev-request@xxxxxxxxxxx?Subject=unsubscribe>
List-software: Ecartis version 1.0.0
List-Id: <freeciv-dev.freeciv.org>
X-List-ID: <freeciv-dev.freeciv.org>
List-subscribe: <mailto:freeciv-dev-request@xxxxxxxxxxx?Subject=subscribe>
List-owner: <mailto:freeciv-dev-admins@xxxxxxxxxxx>
List-post: <mailto:freeciv-dev@xxxxxxxxxxx>
X-list: freeciv-dev
X-Spam-Status: No (score 0.3): AWL=-0.102, NO_REAL_NAME=0.178, 
UPPERCASE_25_50=0.207
X-Virus-Scanned: by Exiscan on glockenspiel.complete.org at Tue, 02 Aug 
2005 19:13:08 -0500



# examining core.31969 in /games/459283/. ...
# using $FREECIV_PATH 
:/home/freeciv/.freeciv/code/installed/cvs/S2_0/2005-08-02_09.00+mintimeout+original_gamelog/share/freeciv
# running: (echo bt full; echo quit; exec yes '') | gdb  
/home/freeciv/.freeciv/code/installed/cvs/S2_0/2005-08-02_09.00+mintimeout+original_gamelog/share/freeciv/../../bin/civserver
 core.31969
GNU gdb Red Hat Linux (5.2-2)
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...
Core was generated by 
`/home/freeciv/.freeciv/code/installed/cvs/S2_0/2005-08-02_09.00+mintimeout+orig'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /usr/lib/libz.so.1...done.
Loaded symbols for /usr/lib/libz.so.1
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /usr/lib/gconv/ISO8859-1.so...done.
Loaded symbols for /usr/lib/gconv/ISO8859-1.so
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
Reading symbols from /lib/libnss_nisplus.so.2...done.
Loaded symbols for /lib/libnss_nisplus.so.2
Reading symbols from /lib/libnsl.so.1...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/libnss_dns.so.2...done.
Loaded symbols for /lib/libnss_dns.so.2
Reading symbols from /lib/libresolv.so.2...done.
Loaded symbols for /lib/libresolv.so.2
#0  0x0805ac56 in send_unit_info_to_onlookers (dest=0x8213f1c, 
    punit=0x844b118, ptile=0x402a3568, remove_unseen=false) at unittools.c:1976
1976        if ((!pplayer && pconn->observer) 
(gdb) #0  0x0805ac56 in send_unit_info_to_onlookers (dest=0x8213f1c, 
    punit=0x844b118, ptile=0x402a3568, remove_unseen=false) at unittools.c:1976
        pplayer = (struct player *) 0x0
        myiter = (struct genlist_link *) 0x0
        pconn = (struct connection *) 0x817e5a0
        dest = (struct conn_list *) 0x817e5a0
        info = {id = 379, owner = 5, x = 72, y = 61, homecity = 297, 
  veteran = 0, ai = false, paradropped = false, connecting = false, 
  transported = false, done_moving = false, type = 4, transported_by = 0, 
  movesleft = 3, hp = 10, fuel = 0, activity_count = 0, unhappiness = 0, 
  upkeep = 1, upkeep_food = 0, upkeep_gold = 0, occupy = 0, goto_dest_x = 255, 
  goto_dest_y = 255, activity = ACTIVITY_FORTIFIED, 
  activity_target = S_NO_SPECIAL, has_orders = false, orders_length = 0, 
  orders_index = 0, orders_repeat = false, orders_vigilant = false, orders = {
    135114181, 136386524, 136386524, 3221197960, 134666934, 1076495528, 
    136425260, 3221197976, 137465248, 137465248, 136425260, 3221198008, 
    135111939, 136425260, 136386524, 3221198024, 135123899, 136773908, 10, 
    3221222264, 135787264, 136425260, ORDER_MOVE, 3221222264, 134589582, 
    136425260, 137465248, 1076495528, ORDER_MOVE, 136386524, 136386524, 
    3221198072, ORDER_MOVE, 409, ORDER_ACTIVITY, 72, 59, 24, ORDER_FULL_MP, 
    ORDER_MOVE, ORDER_MOVE, ORDER_FULL_MP, 10, ORDER_MOVE, 356, ORDER_MOVE, 
    ORDER_MOVE, ORDER_MOVE, 135787264, 409, ORDER_ACTIVITY, 72, 59, 178, 
    ORDER_FULL_MP, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_FULL_MP, 
    ORDER_MOVE, 24, 356, ORDER_LAST, 10, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, 
    ORDER_FULL_MP, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, 72, 61, ORDER_MOVE, 
    ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, 
    59, 178, ORDER_FULL_MP, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_FULL_MP, 
    ORDER_MOVE, 24, 356, ORDER_LAST, 10, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, 
    ORDER_FULL_MP, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, 72, 61, 10, ORDER_MOVE, 
    ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, 134979724, 
    135787264, 9, 3221222632, 134639006, ORDER_MOVE, ORDER_MOVE, 3221222632, 
    134589623, 136425260, 136463996, 3221222632, 134589719, ORDER_MOVE, 
    ORDER_MOVE, ORDER_MOVE, ORDER_FULL_MP, 358, 8, ORDER_MOVE, 72, 16, 
    ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, 10, 9, ORDER_MOVE, 
    ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, 358, 8, ORDER_MOVE, 72, 
    ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, 
    ORDER_MOVE, 16, ORDER_MOVE, 6, 10, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, 
    ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, 255, 255, 9, ORDER_MOVE, 
    ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, ORDER_MOVE, 1684824418, 
    1819236128, 1411409254, 6647407, 1919181136, 543648097, 1918985552, 
    1241539955, 1277193577, 1768649313, 1632370798, 1193310564, 1869047154, 
    1191213426, 1819112047, 1752459617, 1969310976, 1866932324, 6647406, 
    1751345485, 543974753, 1769365828, 1291875444, 1634231145, 1126198373, 
    1768713327, 1241543534, 1936026977...}, orders_dirs = {137461720, 
    146533496, 8, 3221205976, 134821533, 137461720, 146533496, 3221205976, 
    134848130, 3221206048, DIR8_NORTHEAST, DIR8_EAST, 3221206048, 321, 
    3221206048, 3221210200, 134956617, 135783840, 3221206080, 321, 3221206080, 
    144, DIR8_NORTHWEST, 9, 3221206048, DIR8_NORTHWEST, DIR8_NORTHWEST, 19, 
    145096124, DIR8_NORTH, 146533496, 3221210240, 1857125767, 3221206080, 
    4096, 321, DIR8_NORTHEAST, DIR8_NORTHWEST, 146590328, 3221210264, 
    134928532, 2267496705, 141472125, 1684107074, DIR8_NORTHWEST, 
    DIR8_NORTHWEST, DIR8_WEST, DIR8_WEST, DIR8_NORTHWEST, DIR8_SOUTHWEST, 
    DIR8_NORTHWEST, DIR8_NORTHWEST, DIR8_NORTHWEST, DIR8_WEST, DIR8_SOUTHWEST, 
    DIR8_NORTHWEST, DIR8_NORTH, DIR8_NORTHWEST, DIR8_NORTH, DIR8_SOUTHWEST, 
    DIR8_SOUTHWEST, DIR8_SOUTHEAST, DIR8_SOUTH, DIR8_NORTHEAST, 
    DIR8_SOUTHEAST, DIR8_EAST, DIR8_NORTH, DIR8_NORTHEAST, DIR8_NORTH, 
    DIR8_NORTHEAST, DIR8_NORTH, DIR8_NORTHEAST, DIR8_EAST, DIR8_EAST, 
    DIR8_NORTHEAST, DIR8_NORTHEAST, DIR8_NORTHEAST, DIR8_NORTHEAST, 
    DIR8_NORTHEAST, DIR8_NORTHEAST, DIR8_NORTHEAST, DIR8_NORTH, DIR8_NORTH, 
    DIR8_NORTHWEST, DIR8_NORTHWEST, DIR8_NORTHWEST, DIR8_NORTHWEST, 
    DIR8_NORTHWEST, DIR8_NORTHWEST, DIR8_WEST, 83886080, DIR8_NORTHWEST, 1280, 
    83886080, DIR8_NORTHWEST, 1280, 83886080, DIR8_NORTHWEST, DIR8_NORTHWEST, 
    25700, DIR8_SOUTHWEST, DIR8_NORTHWEST, DIR8_SOUTHWEST, DIR8_NORTHWEST, 
    DIR8_NORTHWEST, DIR8_NORTH, DIR8_NORTH, DIR8_NORTH, DIR8_NORTH, 
    DIR8_NORTHWEST, DIR8_NORTHEAST, DIR8_NORTH, DIR8_NORTHWEST, 
    DIR8_NORTHEAST, DIR8_NORTHWEST, DIR8_NORTH, DIR8_NORTHWEST, 
    DIR8_NORTHWEST, DIR8_WEST, DIR8_WEST, DIR8_NORTHEAST, DIR8_NORTHWEST, 
    DIR8_NORTHEAST, DIR8_NORTHWEST, DIR8_NORTHEAST, DIR8_NORTHWEST, 
[... 160 lines skipped ...]
        myiter = (struct genlist_link *) 0x0
        pplayer = (struct player *) 0x82117dc
        ptile = (struct tile *) 0x402a3568
        pcity = (struct city *) 0x0
        old_known = true
#3  0x0806c455 in unfog_area (pplayer=0x82117dc, ptile=0x402a1d08, len=1)
    at maphand.c:686
        tile1 = (struct tile *) 0x402a3568
        _x_itr = 72
        _y_itr = 61
        dummy_y = 138719512
        _index = 5
#4  0x0805c3a3 in move_unit (punit=0x8318da0, pdesttile=0x402a1d08, 
    move_cost=3) at unittools.c:2717
        pplayer = (struct player *) 0x82117dc
        psrctile = (struct tile *) 0x402a04a8
        pcity = (struct city *) 0x5
        ptransporter = (struct unit *) 0x0
#5  0x0808c481 in handle_unit_move_request (punit=0x8318da0, 
    pdesttile=0x402a1d08, igzoc=false, move_diplomat_city=true)
    at unithand.c:1146
        move_cost = 5
        punit = (struct unit *) 0x8318da0
        pdesttile = (struct tile *) 0x402a1d08
        igzoc = false
        move_diplomat_city = true
        pplayer = (struct player *) 0x82117dc
        pcity = (struct city *) 0x0
#6  0x080eeb06 in ai_unit_move (punit=0x8318da0, ptile=0x402a1d08)
    at aitools.c:545
        punit = (struct unit *) 0x8318da0
        ptile = (struct tile *) 0x402a1d08
        bodyguard = (struct unit *) 0x3
        sanity = 409
        pplayer = (struct player *) 0x3
#7  0x08069dd1 in do_unit_goto (punit=0x8318da0, restriction=GOTO_MOVE_ANY, 
    trigger_special_ability=false) at gotohand.c:1362
        last_tile = 5
        success = false
        penemy = (struct unit *) 0x0
        dir = 5
        punit = (struct unit *) 0x8318da0
        pplayer = (struct player *) 0x82117dc
        unit_id = 409
        status = 1076501768
        ptile = (struct tile *) 0x402a1d08
        dest_tile = (struct tile *) 0x402a3568
        waypoint_tile = (struct tile *) 0x402a3568
#8  0x080ee391 in ai_unit_goto (punit=0x8318da0, ptile=0x402a3568)
    at aitools.c:286
        punit = (struct unit *) 0x8318da0
        ptile = (struct tile *) 0x5
        result = GR_FAILED
        old_tile = (struct tile *) 0x402a3568
        activity = ACTIVITY_IDLE
#9  0x080ee2f0 in ai_gothere (pplayer=0x82117dc, punit=0x8318da0, 
    dest_tile=0x402a3568) at aitools.c:246
        punit = (struct unit *) 0x8318da0
        dest_tile = (struct tile *) 0x402a3568
#10 0x080f2668 in ai_military_attack (pplayer=0x82117dc, punit=0x8318da0)
    at aiunit.c:1796
        punit = (struct unit *) 0x8318da0
        dest_tile = (struct tile *) 0x402a3568
        id = 409
        ct = 10
        pcity = (struct city *) 0xa
#11 0x080f2c82 in ai_manage_military (pplayer=0x82117dc, punit=0x8318da0)
    at aiunit.c:2048
        pplayer = (struct player *) 0x82117dc
        punit = (struct unit *) 0x8318da0
        id = 409
#12 0x080f322e in ai_manage_units (pplayer=0x82117dc) at aiunit.c:2208
        punit = (struct unit *) 0x5
        _ids = (int (*)[0]) 0xbffff510
        _i = 0
        _size = 19
#13 0x0804e1d3 in ai_start_turn () at srv_main.c:465
        pplayer = (struct player *) 0x5
        i = 7
#14 0x0804e35e in begin_phase (is_new_phase=true) at srv_main.c:546
        is_new_phase = true
        pplayer = (struct player *) 0x822467c
        PI_p_itr = 9
#15 0x0804f8b3 in main_loop () at srv_main.c:1555
        eot_timer = (struct timer *) 0x84fcae8
        save_counter = 1
        is_new_turn = true
#16 0x0804fa8d in srv_main () at srv_main.c:1674
No locals.
#17 0x0804a5f0 in main (argc=14, argv=0xbffff6d4) at civserver.c:200
        argc = 14
        argv = (char **) 0xbffff6d4
        inx = 14
        showhelp = false
        showvers = false
        option = 0x5 <Address 0x5 out of bounds>
#18 0x400651c4 in __libc_start_main () from /lib/libc.so.6
No symbol table info available.
(gdb) 

Index: server/unittools.c
===================================================================
RCS file: /home/freeciv/CVS/freeciv/server/unittools.c,v
retrieving revision 1.306.2.15
diff -p -u -r1.306.2.15 unittools.c
--- server/unittools.c  26 Jun 2005 11:15:08 -0000      1.306.2.15
+++ server/unittools.c  3 Aug 2005 00:27:20 -0000
@@ -1960,9 +1960,9 @@ void send_unit_info_to_onlookers(struct 
     struct player *pplayer = pconn->player;
     
     if ((!pplayer && pconn->observer) 
-       || pplayer->player_no == punit->owner) {
+       || (pplayer && pplayer->player_no == punit->owner)) {
       send_packet_unit_info(pconn, &info);
-    } else {
+    } else if (pplayer) {
       if (can_player_see_unit_at(pplayer, punit, punit->tile)
          || can_player_see_unit_at(pplayer, punit, ptile)) {
        send_packet_unit_short_info(pconn, &sinfo);