crash after many lines are added to a dialog

[yuhquah]

can be reproduced by harvesting a certain cactus in certain map at wrong time as part of a certain recent quest.

 

harvesting at wrong time gives you a dialog with something along the lines of "this is not a right time to harvest it."

 

if you keep harvesting, not closing the dialog, this same text will be added to the dialog contents again and again.

 

after a while (a few ten harvests or so), the client crashes. the crash dialog gives this output:

 

el.x86.linux.bin: malloc.c:3097: sYSMALLOc: Assertion `(old_top == (((mbinptr) (((char *) &((av)->bins[((1) - 1) * 2])) - __builtin_offsetof (struct malloc_chunk, fd)))) && old_size == 0) || ((unsigned long) (old_size) >= (unsigned long)((((__builtin_offsetof (struct malloc_chunk, fd_nextsize))+((2 * (sizeof(size_t))) - 1)) & ~((2 * (sizeof(size_t))) - 1))) && ((old_top)->size & 0x1) && ((unsigned long)old_end & pagemask) == 0)' failed.

 

 

linux client (from a debian/ubuntu package) on 32-bit x86, but I suspect this is a platform-agnostic bug.

[bluap]

Thanks for reporting the bug. This patch will (I'm pretty confident) fix it:

 

Index: serverpopup.c
===================================================================
RCS file: /cvsroot/elc/elc/serverpopup.c,v
retrieving revision 1.8
diff -a -u -r1.8 serverpopup.c
--- serverpopup.c	12 Jul 2009 20:32:58 -0000	1.8
+++ serverpopup.c	14 Nov 2010 18:31:52 -0000
@@ -312,7 +312,7 @@
		char *sep_str = "\n\n";

		/* resize to hold new message text + separator */
-		resize_text_message_data (&widget_text, widget_text.size + 2*(strlen(message)+strlen(sep_str)));
+		resize_text_message_data (&widget_text, widget_text.len + 2*(strlen(message)+strlen(sep_str)));

		/* copy the message text into the text buffer */
		safe_strcat (widget_text.data, sep_str, widget_text.size);

 

Edit: I've been building new Ubuntu packages today anyway so I included this change. I've also committed the change to CVS.

Edited November 14, 2010 by bluap