[Pingus-CVS] [Bug #696] pingu explodes near the bottom/right level border causes segfault

[nobody]

=================== BUG #696: FULL BUG SNAPSHOT ===================
http://savannah.gnu.org/bugs/?func=detailbug&bug_id=696&group_id=2184

Submitted by: None                      Project: Pingus                         
Submitted on: 2002-Jun-18 15:19
Category:  Game Engine                  Severity:  5 - Major                    
Bug Group:  Crash Error                 Resolution:  None                       
Assigned to:  None                      Status:  Open                           
Release:  None                          Platform Version:  None                 

Summary:  pingu explodes near the bottom/right level border causes segfault

Original Submission:  The reason for that must be a bufferoverflow and a 
missing bounds check somewhere in blitter.cxx.

#0  PingusSpotMap::remove(CL_SurfaceProvider*, int, int) (this=0x81e08b0, 
sprovider=0x88bd128, x=1156, 
    y=559) at spot_map.hxx:44
44        inline bool is_empty(void) { return empty; }
(gdb) where
#0  PingusSpotMap::remove(CL_SurfaceProvider*, int, int) (this=0x81e08b0, 
sprovider=0x88bd128, x=1156, 
    y=559) at spot_map.hxx:44
#1  0x080629f8 in PinguMap::remove(CL_Surface const&, int, int) 
(this=0x81e08b0, address@hidden, x=1156, 
    y=559) at pingu_map.cxx:50
#2  0x080dc139 in Bomber::update(float) (this=0x8850ad8, delta=0.0340000018) at 
../worldobj.hxx:42
#3  0x0805a12f in Pingu::update(float) (this=0x867bf88, delta=0.0340000018) at 
pingu.cxx:305
#4  0x080c25d0 in World::update(float) (this=0x81f1cf8, delta=0.0340000018)
    at /usr/include/g++-v3-3.1/bits/stl_list.h:138
#5  0x08066010 in Client::update(float) (this=0x8609668, delta=0.0340000018) at 
client.cxx:249
#6  0x08065e11 in Client::play_level(PLF*) (this=0x8609668, arg_plf=0x198) at 
delta_manager.hxx:35
#7  0x080656a4 in Client::display() (this=0x8609668) at client.cxx:93
#8  0x0809b77a in PingusGameSession::start() (this=0x198) at game_session.cxx:50
#9  0x0806e112 in PingusMain::start_game() (this=0x8166910) at 
pingus_main.cxx:829
#10 0x0806e8d9 in PingusMain::main(int, char**) (this=0x8166910, argc=2, 
argv=0x8166910)
    at pingus_main.cxx:877
#11 0x0809fa0c in GenericMain::main(int, char**) (this=0x8162aa4, argc=2, 
argv=0xbffffa24)
    at generic_main.cxx:89
#12 0x40107d63 in main (argc=2, argv=0xbffffa24) at 
Sources/Application/Unix/clanapp.cpp:32
Current language:  auto; currently c++
(gdb) 




No Followups Have Been Posted




No files currently attached


For detailed info, follow this link:
http://savannah.gnu.org/bugs/?func=detailbug&bug_id=696&group_id=2184