GOB: URBAN: Qutting via GMM causes crash

[dafioram]

ScummVM: 2.1.0git-31-gc78fa86860
Game: Urban Runner DOS/English
OS: Ubuntu 17.04

1. Start game.
2. Open GMM and hit quit.

#0  0x00007ffff481a77f in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:58
#1  0x00007ffff481c37a in __GI_abort () at abort.c:89
#2  0x00007ffff485e090 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff4974000 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff4867c3a in malloc_printerr (ar_ptr=<optimized out>, ptr=<optimized out>, str=0x7ffff4974110 "double free or corruption (out)", action=3) at malloc.c:5048
#4  0x00007ffff4867c3a in _int_free (av=<optimized out>, p=<optimized out>, have_lock=<optimized out>) at malloc.c:3904
#5  0x00007ffff486bd2c in __GI___libc_free (mem=<optimized out>) at malloc.c:2984
#6  0x00005555557cc499 in Graphics::Surface::free() (this=0x555556e4aea8) at graphics/surface.cpp:80
#7  0x0000555555719842 in GUI::GraphicsWidget::~GraphicsWidget() (this=0x555556e4ae10, __in_chrg=<optimized out>) at gui/widget.cpp:741
#8  0x000055555571986a in GUI::GraphicsWidget::~GraphicsWidget() (this=0x555556e4ae10, __in_chrg=<optimized out>) at gui/widget.cpp:742
#9  0x00005555557161d2 in GUI::Widget::~Widget() (this=0x555556e4af00, __in_chrg=<optimized out>) at gui/widget.cpp:82
#10 0x000055555571a980 in GUI::StaticTextWidget::~StaticTextWidget() (this=0x555556e4af00, __in_chrg=<optimized out>) at ./gui/widget.h:181
#11 0x000055555571a99c in GUI::StaticTextWidget::~StaticTextWidget() (this=0x555556e4af00, __in_chrg=<optimized out>) at ./gui/widget.h:181
#12 0x00005555557161d2 in GUI::Widget::~Widget() (this=0x555556e4afd0, __in_chrg=<optimized out>) at gui/widget.cpp:82
#13 0x000055555571a980 in GUI::StaticTextWidget::~StaticTextWidget() (this=0x555556e4afd0, __in_chrg=<optimized out>) at ./gui/widget.h:181
#14 0x000055555571a9f4 in GUI::ButtonWidget::~ButtonWidget() (this=0x555556e4afd0, __in_chrg=<optimized out>) at ./gui/widget.h:200
#15 0x000055555571aa18 in GUI::ButtonWidget::~ButtonWidget() (this=0x555556e4afd0, __in_chrg=<optimized out>) at ./gui/widget.h:200
#16 0x00005555557161d2 in GUI::Widget::~Widget() (this=0x555556e4b0c0, __in_chrg=<optimized out>) at gui/widget.cpp:82
#17 0x000055555571a980 in GUI::StaticTextWidget::~StaticTextWidget() (this=0x555556e4b0c0, __in_chrg=<optimized out>) at ./gui/widget.h:181
#18 0x000055555571a9f4 in GUI::ButtonWidget::~ButtonWidget() (this=0x555556e4b0c0, __in_chrg=<optimized out>) at ./gui/widget.h:200
#19 0x000055555571aa18 in GUI::ButtonWidget::~ButtonWidget() (this=0x555556e4b0c0, __in_chrg=<optimized out>) at ./gui/widget.h:200
#20 0x00005555557161d2 in GUI::Widget::~Widget() (this=0x555556e4b1b0, __in_chrg=<optimized out>) at gui/widget.cpp:82
#21 0x000055555571a980 in GUI::StaticTextWidget::~StaticTextWidget() (this=0x555556e4b1b0, __in_chrg=<optimized out>) at ./gui/widget.h:181
#22 0x000055555571a9f4 in GUI::ButtonWidget::~ButtonWidget() (this=0x555556e4b1b0, __in_chrg=<optimized out>) at ./gui/widget.h:200
#23 0x000055555571aa18 in GUI::ButtonWidget::~ButtonWidget() (this=0x555556e4b1b0, __in_chrg=<optimized out>) at ./gui/widget.h:200
#24 0x00005555557161d2 in GUI::Widget::~Widget() (this=0x555556e4b2a0, __in_chrg=<optimized out>) at gui/widget.cpp:82
#25 0x000055555571a980 in GUI::StaticTextWidget::~StaticTextWidget() (this=0x555556e4b2a0, __in_chrg=<optimized out>) at ./gui/widget.h:181
#26 0x000055555571a9f4 in GUI::ButtonWidget::~ButtonWidget() (this=0x555556e4b2a0, __in_chrg=<optimized out>) at ./gui/widget.h:200
#27 0x000055555571aa18 in GUI::ButtonWidget::~ButtonWidget() (this=0x555556e4b2a0, __in_chrg=<optimized out>) at ./gui/widget.h:200
#28 0x00005555557161d2 in GUI::Widget::~Widget() (this=0x555556e4b390, __in_chrg=<optimized out>) at gui/widget.cpp:82
#29 0x000055555571a980 in GUI::StaticTextWidget::~StaticTextWidget() (this=0x555556e4b390, __in_chrg=<optimized out>) at ./gui/widget.h:181
#30 0x000055555571a9f4 in GUI::ButtonWidget::~ButtonWidget() (this=0x555556e4b390, __in_chrg=<optimized out>) at ./gui/widget.h:200
#31 0x000055555571aa18 in GUI::ButtonWidget::~ButtonWidget() (this=0x555556e4b390, __in_chrg=<optimized out>) at ./gui/widget.h:200
#32 0x00005555557161d2 in GUI::Widget::~Widget() (this=0x555556e4b480, __in_chrg=<optimized out>) at gui/widget.cpp:82
#33 0x000055555571a980 in GUI::StaticTextWidget::~StaticTextWidget() (this=0x555556e4b480, __in_chrg=<optimized out>) at ./gui/widget.h:181
#34 0x000055555571a9f4 in GUI::ButtonWidget::~ButtonWidget() (this=0x555556e4b480, __in_chrg=<optimized out>) at ./gui/widget.h:200
#35 0x000055555571aa18 in GUI::ButtonWidget::~ButtonWidget() (this=0x555556e4b480, __in_chrg=<optimized out>) at ./gui/widget.h:200
#36 0x00005555557161d2 in GUI::Widget::~Widget() (this=0x5555564a6770, __in_chrg=<optimized out>) at gui/widget.cpp:82
#37 0x000055555571a980 in GUI::StaticTextWidget::~StaticTextWidget() (this=0x5555564a6770, __in_chrg=<optimized out>) at ./gui/widget.h:181
#38 0x000055555571a9f4 in GUI::ButtonWidget::~ButtonWidget() (this=0x5555564a6770, __in_chrg=<optimized out>) at ./gui/widget.h:200
#39 0x000055555571aa18 in GUI::ButtonWidget::~ButtonWidget() (this=0x5555564a6770, __in_chrg=<optimized out>) at ./gui/widget.h:200
#40 0x00005555557161d2 in GUI::Widget::~Widget() (this=0x5555564a6860, __in_chrg=<optimized out>) at gui/widget.cpp:82
#41 0x000055555571a980 in GUI::StaticTextWidget::~StaticTextWidget() (this=0x5555564a6860, __in_chrg=<optimized out>) at ./gui/widget.h:181
#42 0x000055555571a9f4 in GUI::ButtonWidget::~ButtonWidget() (this=0x5555564a6860, __in_chrg=<optimized out>) at ./gui/widget.h:200
#43 0x000055555571aa18 in GUI::ButtonWidget::~ButtonWidget() (this=0x5555564a6860, __in_chrg=<optimized out>) at ./gui/widget.h:200
#44 0x00005555556de016 in GUI::GuiObject::~GuiObject() (this=0x555556e4bf60, __in_chrg=<optimized out>) at gui/object.cpp:38
#45 0x00005555555e0750 in GUI::Dialog::~Dialog() (this=0x555556e4bf60, __in_chrg=<optimized out>) at ./gui/dialog.h:51
#46 0x0000555555777071 in MainMenuDialog::~MainMenuDialog() (this=0x555556e4bf60, __in_chrg=<optimized out>) at engines/dialogs.cpp:119
#47 0x0000555555777092 in MainMenuDialog::~MainMenuDialog() (this=0x555556e4bf60, __in_chrg=<optimized out>) at engines/dialogs.cpp:124
#48 0x0000555555772713 in Engine::~Engine() (this=0x555556698b70, __in_chrg=<optimized out>) at engines/engine.cpp:186
#49 0x00005555555dca59 in Gob::GobEngine::~GobEngine() (this=0x555556698b70, __in_chrg=<optimized out>) at engines/gob/gob.cpp:155
#50 0x00005555555dca74 in Gob::GobEngine::~GobEngine() (this=0x555556698b70, __in_chrg=<optimized out>) at engines/gob/gob.cpp:159
#51 0x00005555555c3d7e in runGame(EnginePlugin const*, OSystem&, Common::String const&) (plugin=0x555555e70ea0, system=..., edebuglevels=...) at base/main.cpp:272
#52 0x00005555555c4f3a in scummvm_main(int, char const* const*) (argc=1, argv=0x7fffffffe058) at base/main.cpp:529
#53 0x00005555555c1e18 in main(int, char**) (argc=1, argv=0x7fffffffe058) at backends/platform/sdl/posix/posix-main.cpp:45

[csnover]

​https://github.com/scummvm/scummvm/pull/1086

[csnover]

Thanks for your report! A patch for this issue has been added in commit 20b2c1b7e156f0586799f7df9d6e93c757dabeac and will be available in daily builds 2.1.0git-34 and later. This patch was also backported to 2.0 in commit 58cbd45ef5b6776b761fc3d51f531a8d12946c24.