Opened 13 years ago

Closed 13 years ago

Last modified 12 years ago

#5781 closed defect (fixed)

DREAMWEB: Crash when inserting key

Reported by: tsoliman Owned by: SF/megath
Priority: normal Component: Engine: Dreamweb
Version: Keywords:
Cc: Game: Dreamweb

Description

scummvm: ../engines/dreamweb/runtime.h:469: void DreamGen::Context::_movsb(uint, bool): Assertion `src < dst || src >= dst + size' failed.

Linux self compiled git revision 4b51bef

To reproduce, load attached save and use key in plinth

Ticket imported from: #3339530. Ticket imported from: bugs/5781.

Attachments (1)

DREAMWEB.D00 (12.2 KB ) - added by tsoliman 13 years ago.
savegame: Use plinth and select key

Download all attachments as: .zip

Change History (14)

by tsoliman, 13 years ago

Attachment: DREAMWEB.D00 added

savegame: Use plinth and select key

comment:1 by SF/megath, 13 years ago

Also the same crash after robbery in louis flat and after taking sneakers. I removed workaround, because it corrupts the game state. Still investingating :)

comment:2 by SF/megath, 13 years ago

Owner: set to SF/megath

comment:3 by wjp, 13 years ago

This is the assert added in d413494f5b0485008bbc6074fca07bb00f448c40.

comment:4 by wjp, 13 years ago

If it's caused by replacing a rep movsb by a memcpy, shouldn't we then just not be using memcpy for overlapping regions there? (But a simple loop instead?)

comment:5 by SF/megath, 13 years ago

I guess it's a bug, removing assert or replacing with movsb() corrupts game state and sometime trashes inventory. I'm not 100% sure though.

comment:6 by SF/megath, 13 years ago

hmmm, wjp, I guess you're right. I disabled memcpy for overlapping regions and louis and this key crash does not reproduce! Thank you. I'll commit the fix right away

comment:7 by SF/megath, 13 years ago

Please update!

comment:8 by SF/megath, 13 years ago

Resolution: fixed

comment:9 by eriktorbjorn, 13 years ago

Maybe I'm missing something obvious but if the problem is overlapping memory areas, couldn't we just change memcpy() to memmove()?

comment:10 by wjp, 13 years ago

That would probably work in all actually used cases, but a rep movsb isn't always equivalent to a memmove. (Not when copying forward with overlap.)

comment:11 by SF/megath, 13 years ago

Yes, di/si register wrap at 0x10000.

comment:12 by wjp, 13 years ago

Status: newclosed

comment:13 by digitall, 12 years ago

Component: Engine: Dreamweb
Game: Dreamweb
Note: See TracTickets for help on using tickets.