Fix the tester 'buttons crash the game' report: two keyboard killers
Reproduced by full-keyboard fuzz (every WM_CHAR + WM_KEYUP posted to the game window, per-key liveness; delivery proven by the new BT_KEY_LOG [keych] trace). Two distinct issues: 1) '&' == Shift+7 is the engine's dev-console STOP-MISSION keystroke -- one shifted-key slip while hunting unmapped panel keys (MAP zoom '+' is Shift+'=') instantly ended the session, indistinguishable from a crash. Now env-gated (APP.cpp): default ignored with a log line; BT_KEY_STOP=1 restores the authentic stop (verified both ways live). Same hazard class as the arrow-release '&' alias already swallowed in L4CTRL.cpp:1516. 2) '\' (the developer fake-event key) was a REAL wild-jump crash: Entity::Dispatch STAMPS entityID/interestZoneID into the message at Entity::Message offsets (ENTITY.cpp:236), and the '\' case dispatched a bare Receiver-sized ReceiverDataMessageOf<ControlsButton> at the Mech -- the stamp wrote past the stack object and corrupted the frame (cdb: call to eip=1 out of Receiver::Receive). The 1995 binary does the identical overwrite and survived on stack-layout luck. Fixed with Entity::Message-sized placement-new backing (btl4mppr.cpp); the only such call site (grep-verified). Verified: full fuzz (95 chars + F-keys + letter/digit keyups, 118 keys delivered) survives end-to-end; '&' stops cleanly under BT_KEY_STOP=1. KB: reconstruction-gotchas.md gains gotcha 19 (Entity::Dispatch message stamping) + the '&' note. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
arcattack
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
1ed8b05160
commit
e2c21c4db2
@@ -369,6 +369,29 @@ tick's `!IsNonReplicantExecutable()` branch to name the slot + dump `simulationF
|
||||
DontExecute). **Rule:** zero every hand-built resource struct; never rely on a partially-filled one.
|
||||
[T2]
|
||||
|
||||
## 19. Entity::Dispatch STAMPS the message — a bare Receiver message overflows its stack frame
|
||||
|
||||
**Symptom:** a wild-jump crash (`eip=1`-style) one call after dispatching a message AT AN ENTITY —
|
||||
the tester's `'\'` dev key instantly "crashed the game". **Cause:** `Entity::Dispatch`
|
||||
(ENTITY.cpp:236) WRITES `entityID` + `interestZoneID` into the incoming message at
|
||||
`Entity::Message` offsets before routing. A bare `ReceiverDataMessageOf<T>` (Receiver-sized) on
|
||||
the stack gets written PAST ITS END → the caller's frame is corrupted → wild jump. The 1995
|
||||
binary performs the identical overwrite and survived on stack-layout luck. Subsystem/Receiver
|
||||
`Dispatch` does NOT stamp — only the Entity level. **Rule:** any message dispatched at an
|
||||
`Entity` must have `Entity::Message`-sized backing (derive from `Entity::Message`, or placement-
|
||||
new the small message into a padded buffer — the `'\'` fake-event fix, btl4mppr.cpp
|
||||
`DispatchDeveloperFakeEvent`). Sibling of the MakeMessage inline-string wire rule
|
||||
([[multiplayer]] "wire-format bug class"). [T2]
|
||||
|
||||
**Related — the '&' STOP-MISSION keystroke read as "the game crashes":** `'&'` (Shift+7!) is the
|
||||
engine's dev-console stop keystroke (`Application::KeyCommandMessageHandler`) — one shifted-key
|
||||
slip while hunting unmapped panel keys (MAP zoom `'+'` is Shift+`'='`) instantly ended the
|
||||
session, indistinguishable from a crash to a tester. Now env-gated: default IGNORED (logged),
|
||||
`BT_KEY_STOP=1` restores the authentic stop (APP.cpp; the arrow-release `'&'` alias was already
|
||||
swallowed for the same hazard, L4CTRL.cpp:1516). Full-keyboard fuzz (every printable char +
|
||||
F-keys posted as WM_CHAR/WM_KEYUP, `[keych]` delivery-proof under `BT_KEY_LOG`) now survives
|
||||
end-to-end. [T2]
|
||||
|
||||
**Related — raw numeric attribute index into a GROWING table (same root as gotcha 11):** the dev
|
||||
gauges' `CoolingLoopConnection` reached the cooling master with a RAW `GetAttributePointer(3)` +
|
||||
`*(master+0x1d4)` walk. The July-16 audio work inserted attribute rows (`ReportLeak` etc.), shifting
|
||||
|
||||
@@ -1736,6 +1736,29 @@ void
|
||||
switch (message->dataContents)
|
||||
{
|
||||
case '&':
|
||||
//
|
||||
// BT port guard (tester "crash" report, 2026-07-17): '&' is the 1995
|
||||
// dev-console STOP-MISSION keystroke. On the desktop rig the keyboard
|
||||
// IS the player interface, and Shift+7 == '&' -- one slip while hunting
|
||||
// panel keys (MAP zoom '+' is Shift+'=' two keys away) instantly ended
|
||||
// the session, indistinguishable from a crash. The keystroke now
|
||||
// requires BT_KEY_STOP=1 (the arrow-RELEASE '&' alias was already
|
||||
// swallowed for the same hazard, L4CTRL.cpp:1516).
|
||||
//
|
||||
{
|
||||
static int sAllowStop = -1;
|
||||
if (sAllowStop < 0)
|
||||
{
|
||||
const char *e = getenv("BT_KEY_STOP");
|
||||
sAllowStop = (e != NULL && e[0] == '1') ? 1 : 0;
|
||||
}
|
||||
if (!sAllowStop)
|
||||
{
|
||||
DEBUG_STREAM << "'&' stop-mission keystroke ignored"
|
||||
" (set BT_KEY_STOP=1 to enable)\n" << std::flush;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (GetApplicationState() != StoppingMission)
|
||||
{
|
||||
Exit_Code = 1;
|
||||
|
||||
@@ -92,6 +92,8 @@
|
||||
#include <bt.hpp>
|
||||
#pragma hdrstop
|
||||
|
||||
#include <new> // placement-new (the '\' fake-event padded message)
|
||||
|
||||
#if !defined(BTL4MPPR_HPP)
|
||||
# include <btl4mppr.hpp>
|
||||
#endif
|
||||
@@ -205,9 +207,22 @@ static void
|
||||
{
|
||||
case 0x5c: // '\' -- momentary press straight onto the owner Mech
|
||||
{
|
||||
ReceiverDataMessageOf<ControlsButton>
|
||||
press(0x19, sizeof(ReceiverDataMessageOf<ControlsButton>), 1);
|
||||
mapper->GetMech()->Dispatch(&press); // (this+0xd0)->vtbl+0xc
|
||||
// STACK-OVERWRITE FIX (tester "crash" hunt, 2026-07-17):
|
||||
// Entity::Dispatch STAMPS entityID/interestZoneID into the message
|
||||
// at Entity::Message offsets (ENTITY.cpp:236) -- dispatching a bare
|
||||
// ReceiverDataMessageOf<ControlsButton> at an ENTITY writes past
|
||||
// the stack object and corrupts the frame (the '\' key was an
|
||||
// instant wild-jump crash; the 1995 build survived the identical
|
||||
// overwrite on stack-layout luck). Give the message
|
||||
// Entity::Message-sized backing so the stamp lands in owned
|
||||
// memory; messageID/messageLength semantics are unchanged.
|
||||
double storage[
|
||||
(sizeof(Entity::Message) + sizeof(ReceiverDataMessageOf<ControlsButton>))
|
||||
/ sizeof(double) + 1];
|
||||
ReceiverDataMessageOf<ControlsButton> *press =
|
||||
new ((void *)storage) ReceiverDataMessageOf<ControlsButton>(
|
||||
0x19, sizeof(ReceiverDataMessageOf<ControlsButton>), 1);
|
||||
mapper->GetMech()->Dispatch(press); // (this+0xd0)->vtbl+0xc
|
||||
}
|
||||
break;
|
||||
case 0x15e: SendFakeButtonEvent("GeneratorA", 0); break;
|
||||
@@ -655,6 +670,11 @@ L4MechControlsMapper::MessageHandlerSet&
|
||||
ReceiverDataMessageOf<ControlsKey> *message
|
||||
)
|
||||
{
|
||||
// DIAG (BT_KEY_LOG): trace every key that reaches the cockpit keyboard
|
||||
// dispatcher -- proves delivery + names the key in a crash repro.
|
||||
if (getenv("BT_KEY_LOG"))
|
||||
DEBUG_STREAM << "[keych] 0x" << std::hex << (int)message->dataContents
|
||||
<< std::dec << "\n" << std::flush;
|
||||
switch (message->dataContents)
|
||||
{
|
||||
// ---- target range zoom ----
|
||||
|
||||
Reference in New Issue
Block a user