vwemirror/BT411
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Death-crash FIXED: 25-voice explosion preset overflowed the 5-slot audio SourceSet (Gitea #12)

Browse Source 
The weekend's crash family root-caused under cdb: SourceSet.sources[5]
receives the AllExplosion death preset's 25 streamed voices --
RequestAudioChannels wrote 20 OpenAL source ids past the array, smashing
the neighbouring heap object (Release: a vtable overwritten with a source
id -> delayed silent AV at AudioControlEvent::Send; Debug: CRT heap-
corruption abort in the death Explosion's audio teardown).  Explains all
three #12 crash flavors (solo enemy kill -- stack-confirmed; MP self-
death; MP peer PEER_DOWN cascade -- same generic teardown).

Fix: sources[] sized to AUDIO_SOURCESET_CAPACITY=25, static_assert
lockstep with MAX_PRESET_SAMPLES, + defence-in-depth clamps at the ctor
and acquisition sites.  Soak: 26+ deaths across glass AND pod builds
under cdb, zero faults, full wreck lifecycle every time.  Gotchas S21:
the fixed-array-vs-streamed-count overflow class + sweep note.

Awaiting human verification: the MP death-and-survive session.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
arcattack
2026-07-20 14:51:35 -05:00
co-authored by Claude Fable 5
parent 6ad1e074cc
commit a0cec48e3f
5 changed files with 90 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
engine/MUNGA_L4/L4AUDRND.cpp
+7
View File
@@ -1294,6 +1294,13 @@ Logical
//Do we have enough?
int requested = source_request->count;
// Gitea #12: hard cap at the SourceSet capacity so alGenSources can never
// write past sources[] (the death-crash heap overflow). count is set from
// the streamed voiceCount and is normally already clamped in the
// L4AudioSource ctor; this guards the acquisition site itself.
if (requested > AUDIO_SOURCESET_CAPACITY)
requested = AUDIO_SOURCESET_CAPACITY;
bool failed = true;
alGetError();