Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

make hitpoint sexps safer to use in debriefing #6514

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

Goober5000
Copy link
Contributor

There is a rather large design flaw in FreeSpace debriefings... debriefing SEXPs can refer to in-mission ship data, while all ships (and all objects) are deleted as soon as the mission completes. Specifically, obj_delete() is called which sets all objects to OBJ_NONE and marks them as freed, although the data still exists in the various arrays. This is the use-after-free problem, but applied to the in-game object system, rather than memory accessed by pointers.

It's probably best to defer fixes to an as-needed basis. As for hitpoint SEXPs, this change updates them to use the object and ship references from the ship registry, since the ship registry is not cleared by the time the debriefing is loaded. (Using objp->instance and shipp->objnum at this point would be problematic.) Since subsystems are also cleared at this point, this also updates the warning messages in those functions.

Fixes an Assert seen in debug mode in Inferno.

Relatedly, fix the calculation of percent_killed. This has been broken ever since commit 6c17ef0 in 2005. Since get_hull_pct() did not return negative values, percent_killed was always 0. Allow negative values in this case.

@Goober5000 Goober5000 added fix A fix for bugs, not-a-bugs, and/or regressions. sexps A feature or issue related to SEXPs labels Jan 11, 2025
There is a rather large design flaw in FreeSpace debriefings... debriefing SEXPs can refer to in-mission ship data, while all ships (and all objects) are deleted as soon as the mission completes.  Specifically, `obj_delete()` is called which sets all objects to `OBJ_NONE` and marks them as freed, although the data still exists in the various arrays.  This is the use-after-free problem, but applied to the in-game object system, rather than memory accessed by pointers.

It's probably best to defer fixes to an as-needed basis.  As for hitpoint SEXPs, this change updates them to use the object and ship references from the ship registry, since the ship registry is not cleared by the time the debriefing is loaded.  (Using `objp->instance` and `shipp->objnum` at this point would be problematic.)  Since subsystems are also cleared at this point, this also updates the warning messages in those functions.

Fixes an Assert seen in debug mode in Inferno.
This has been broken ever since commit 6c17ef0 in 2005.  Since `get_hull_pct()` did not return negative values, `percent_killed` was always 0.  Allow negative values in this case.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
fix A fix for bugs, not-a-bugs, and/or regressions. sexps A feature or issue related to SEXPs
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant