From e2c21c4db2388ec8bbd55376682adc81561fe3e7 Mon Sep 17 00:00:00 2001 From: arcattack Date: Fri, 17 Jul 2026 16:06:46 -0500 Subject: [PATCH] Fix the tester 'buttons crash the game' report: two keyboard killers Reproduced by full-keyboard fuzz (every WM_CHAR + WM_KEYUP posted to the game window, per-key liveness; delivery proven by the new BT_KEY_LOG [keych] trace). Two distinct issues: 1) '&' == Shift+7 is the engine's dev-console STOP-MISSION keystroke -- one shifted-key slip while hunting unmapped panel keys (MAP zoom '+' is Shift+'=') instantly ended the session, indistinguishable from a crash. Now env-gated (APP.cpp): default ignored with a log line; BT_KEY_STOP=1 restores the authentic stop (verified both ways live). Same hazard class as the arrow-release '&' alias already swallowed in L4CTRL.cpp:1516. 2) '\' (the developer fake-event key) was a REAL wild-jump crash: Entity::Dispatch STAMPS entityID/interestZoneID into the message at Entity::Message offsets (ENTITY.cpp:236), and the '\' case dispatched a bare Receiver-sized ReceiverDataMessageOf at the Mech -- the stamp wrote past the stack object and corrupted the frame (cdb: call to eip=1 out of Receiver::Receive). The 1995 binary does the identical overwrite and survived on stack-layout luck. Fixed with Entity::Message-sized placement-new backing (btl4mppr.cpp); the only such call site (grep-verified). Verified: full fuzz (95 chars + F-keys + letter/digit keyups, 118 keys delivered) survives end-to-end; '&' stops cleanly under BT_KEY_STOP=1. KB: reconstruction-gotchas.md gains gotcha 19 (Entity::Dispatch message stamping) + the '&' note. Co-Authored-By: Claude Opus 4.8 (1M context) --- context/reconstruction-gotchas.md | 23 +++++++++++++++++++++++ engine/MUNGA/APP.cpp | 23 +++++++++++++++++++++++ game/reconstructed/btl4mppr.cpp | 26 +++++++++++++++++++++++--- 3 files changed, 69 insertions(+), 3 deletions(-) diff --git a/context/reconstruction-gotchas.md b/context/reconstruction-gotchas.md index e48ce4c..bb79724 100644 --- a/context/reconstruction-gotchas.md +++ b/context/reconstruction-gotchas.md @@ -369,6 +369,29 @@ tick's `!IsNonReplicantExecutable()` branch to name the slot + dump `simulationF DontExecute). **Rule:** zero every hand-built resource struct; never rely on a partially-filled one. [T2] +## 19. Entity::Dispatch STAMPS the message — a bare Receiver message overflows its stack frame + +**Symptom:** a wild-jump crash (`eip=1`-style) one call after dispatching a message AT AN ENTITY — +the tester's `'\'` dev key instantly "crashed the game". **Cause:** `Entity::Dispatch` +(ENTITY.cpp:236) WRITES `entityID` + `interestZoneID` into the incoming message at +`Entity::Message` offsets before routing. A bare `ReceiverDataMessageOf` (Receiver-sized) on +the stack gets written PAST ITS END → the caller's frame is corrupted → wild jump. The 1995 +binary performs the identical overwrite and survived on stack-layout luck. Subsystem/Receiver +`Dispatch` does NOT stamp — only the Entity level. **Rule:** any message dispatched at an +`Entity` must have `Entity::Message`-sized backing (derive from `Entity::Message`, or placement- +new the small message into a padded buffer — the `'\'` fake-event fix, btl4mppr.cpp +`DispatchDeveloperFakeEvent`). Sibling of the MakeMessage inline-string wire rule +([[multiplayer]] "wire-format bug class"). [T2] + +**Related — the '&' STOP-MISSION keystroke read as "the game crashes":** `'&'` (Shift+7!) is the +engine's dev-console stop keystroke (`Application::KeyCommandMessageHandler`) — one shifted-key +slip while hunting unmapped panel keys (MAP zoom `'+'` is Shift+`'='`) instantly ended the +session, indistinguishable from a crash to a tester. Now env-gated: default IGNORED (logged), +`BT_KEY_STOP=1` restores the authentic stop (APP.cpp; the arrow-release `'&'` alias was already +swallowed for the same hazard, L4CTRL.cpp:1516). Full-keyboard fuzz (every printable char + +F-keys posted as WM_CHAR/WM_KEYUP, `[keych]` delivery-proof under `BT_KEY_LOG`) now survives +end-to-end. [T2] + **Related — raw numeric attribute index into a GROWING table (same root as gotcha 11):** the dev gauges' `CoolingLoopConnection` reached the cooling master with a RAW `GetAttributePointer(3)` + `*(master+0x1d4)` walk. The July-16 audio work inserted attribute rows (`ReportLeak` etc.), shifting diff --git a/engine/MUNGA/APP.cpp b/engine/MUNGA/APP.cpp index e6eb8f1..58459d3 100644 --- a/engine/MUNGA/APP.cpp +++ b/engine/MUNGA/APP.cpp @@ -1736,6 +1736,29 @@ void switch (message->dataContents) { case '&': + // + // BT port guard (tester "crash" report, 2026-07-17): '&' is the 1995 + // dev-console STOP-MISSION keystroke. On the desktop rig the keyboard + // IS the player interface, and Shift+7 == '&' -- one slip while hunting + // panel keys (MAP zoom '+' is Shift+'=' two keys away) instantly ended + // the session, indistinguishable from a crash. The keystroke now + // requires BT_KEY_STOP=1 (the arrow-RELEASE '&' alias was already + // swallowed for the same hazard, L4CTRL.cpp:1516). + // + { + static int sAllowStop = -1; + if (sAllowStop < 0) + { + const char *e = getenv("BT_KEY_STOP"); + sAllowStop = (e != NULL && e[0] == '1') ? 1 : 0; + } + if (!sAllowStop) + { + DEBUG_STREAM << "'&' stop-mission keystroke ignored" + " (set BT_KEY_STOP=1 to enable)\n" << std::flush; + break; + } + } if (GetApplicationState() != StoppingMission) { Exit_Code = 1; diff --git a/game/reconstructed/btl4mppr.cpp b/game/reconstructed/btl4mppr.cpp index 85c9051..75c4baf 100644 --- a/game/reconstructed/btl4mppr.cpp +++ b/game/reconstructed/btl4mppr.cpp @@ -92,6 +92,8 @@ #include #pragma hdrstop +#include // placement-new (the '\' fake-event padded message) + #if !defined(BTL4MPPR_HPP) # include #endif @@ -205,9 +207,22 @@ static void { case 0x5c: // '\' -- momentary press straight onto the owner Mech { - ReceiverDataMessageOf - press(0x19, sizeof(ReceiverDataMessageOf), 1); - mapper->GetMech()->Dispatch(&press); // (this+0xd0)->vtbl+0xc + // STACK-OVERWRITE FIX (tester "crash" hunt, 2026-07-17): + // Entity::Dispatch STAMPS entityID/interestZoneID into the message + // at Entity::Message offsets (ENTITY.cpp:236) -- dispatching a bare + // ReceiverDataMessageOf at an ENTITY writes past + // the stack object and corrupts the frame (the '\' key was an + // instant wild-jump crash; the 1995 build survived the identical + // overwrite on stack-layout luck). Give the message + // Entity::Message-sized backing so the stamp lands in owned + // memory; messageID/messageLength semantics are unchanged. + double storage[ + (sizeof(Entity::Message) + sizeof(ReceiverDataMessageOf)) + / sizeof(double) + 1]; + ReceiverDataMessageOf *press = + new ((void *)storage) ReceiverDataMessageOf( + 0x19, sizeof(ReceiverDataMessageOf), 1); + mapper->GetMech()->Dispatch(press); // (this+0xd0)->vtbl+0xc } break; case 0x15e: SendFakeButtonEvent("GeneratorA", 0); break; @@ -655,6 +670,11 @@ L4MechControlsMapper::MessageHandlerSet& ReceiverDataMessageOf *message ) { + // DIAG (BT_KEY_LOG): trace every key that reaches the cockpit keyboard + // dispatcher -- proves delivery + names the key in a crash repro. + if (getenv("BT_KEY_LOG")) + DEBUG_STREAM << "[keych] 0x" << std::hex << (int)message->dataContents + << std::dec << "\n" << std::flush; switch (message->dataContents) { // ---- target range zoom ----