null-byte due to referencing undefined item from struct

[pixelfck]

While modding, I made an error which resulted in an unexpected bug:


I defined the following struct (note the erroneous double declaration of the key 'name'):

Code: Select all

(setq node {
    index: i
    nodeId: "foo"
    name: "bar"
    level: 5
    name: "&ssEarthSpaceStandard;"
    outboundEdgeCount: 1
    attributes: "humanSpace, ungoverned"
    mapEffects: Nil
    })

Somewhere later, I attempt to use the non-declared key (and I write the XML-string I'm putting together to the debug.log file for convenience):

Code: Select all

(setq systemMap (cat systemMap
    (subst "UNID=\"%systemUnid%\"" node)	
    ))

(dbgLog systemMap)

In the debug file I find the following (not the null-byte as the first character of the UNID)

Code: Select all

05/10/2014 17:46:35 <Node ID="foo" x="292" y="55">
    <System UNID=       "\0ystemUnid"
            name=       "0x00000005"
            level=      "5"
            attributes= "humanSpace, ungoverned"
            />
</Node>
05/10/2014 17:46:36	Out of Memory: VirtualAlloc failed committing 20230144 bytes.

I'm not sure the out-of-memory and the null-byte are related, but the null-byte is definately not supposed to be there nor would I expect the system to run out of memory at this point.

Cheers,
Pixelfck

[george moromisato]

I believe the subst function is interpreting the %s (in "%systemUnid...") as a string substitution. It definitely looks like a bug of some sort.

[pixelfck]

The worrying part is that it seems to trigger the out-of-memory error. I can't proof the two are connected, but I do know that fixing the first issue also made the memory issue go away.

~Pixelfck

[george moromisato]

The worrying part is that it seems to trigger the out-of-memory error. I can't proof the two are connected, but I do know that fixing the first issue also made the memory issue go away.

~Pixelfck

I'm fairly certain they are connected.

For efficiency, Transcendence strings have a length prefix. If the call got a bogus string (because of a bug in the string substitution) then the string length could be any number at all. When trying to generate the resulting string, it probably tried to allocate a very large chunk of memory because it thought it needed that much for the (bogus) string.

[george moromisato]

I'm having trouble reproducing this.

Could you attach or email your original mod (before you made the fix)?

[pixelfck]

I realised too late I needed the bugged code, so I checked in a copy just after fixing it. I'll try to get the code to reproduce the error and send you the mod.
~Pixelfck

[pixelfck]

PM send.