Julius: Game crashes after senate destroyed by a criminal of riot

[411752230]

Test save:
test.zip

@crudelios Game crashes a little after the senate is destroyed.

[crudelios]

First debugging results: Apparently the game loads up a random image ID for the rioter figure (got an ID over 30000, when maximum is 10000), which causes the game to crash. Must be some problem related to setting the figure image IDs.

Crashes on line 235of widget\city_figure.c with the error img was nullptr.

[devnoname120]

I've investigated a bit and it seems that:

• Rioter figure (id=81) direction is set to DIR_FIGURE_ATTACK
• image_offset gets set to 16 here.
• It is used as an index to a list that only has 16 elements: CRIMINAL_OFFSETS[f->image_offset].
• Hence it does a out-of-bounds read of 1769234296 which is casted implicitly to short 24440 and added to the image group and 104 leading it to have the value 30473 (not a valid image_id)
• Later the image is fetched and it returns the pointer 0 which is then used without safe guards.

Replacing https://github.com/bvschaik/julius/blob/c42fe2f1e5740aee8d438d69ad086ecce987fe31/src/figuretype/crime.c#L267 with the following resolves the crash:

        unsigned char img_offset = f->image_offset > 15 ? 15 : f->image_offset;
        f->image_id = image_group(GROUP_FIGURE_CRIMINAL) + 104 + CRIMINAL_OFFSETS[img_offset];

I don't think that this is a proper solution because I'm not sure of the root cause. @bvschaik Any ideas?

[crudelios]

Replacing line 214 of julius/src/figuretype/crime.c from:

figure_image_increase_offset(f, 32);

To:

figure_image_increase_offset(f, 16);

Seems to fix the issue entirely.

[devnoname120]

We would need to double-check the game's assembly to make sure that the mistake comes from here.

[crudelios]

From what I gather, it's either the line I mentioned or line 267 is missing a / 2 like in line 271. A way to test it without knowing the original's memory code offset is to compare the rioters visually in Julius and in C3.

[crudelios]

So I've been comparing both my suggested changes to the original C3 and none make the rioter animations look exactly the same.

The change to line 214 I proposed works and the rioter animation becomes smooth, however it isn't smooth in the original. So without knowing the original code as a reference, I'm not sure how to make it look exactly the same.

[bvschaik]

So I looked into what C3 does: there are flotsam offsets defined in the memory after the criminal offsets, and they range from 0 to 4, so that's why it's not a problem in C3. I just took the liberty of adding % 16 to the array index: that way the animation is almost the same as what C3 does.

[devnoname120]

I would recommend adding a comment in the code to explain this, possibly with a link to this issue. It will be helpful if we want in the future to fix the animation to make it smooth.

[bvschaik]

The animation is now already smooth. And the code change is linked to this issue in the git commit message, so we can find it back.