TITANIC: Starship Titanic: Deskbot crash on return respond

[dafioram]

ScummVM: 1.10.0git-3571-gd5ebd9a 64bit
Game: Starship Titanic, GOG (1.00.42c), Windows/English
Tester OS: Win7-64

After talking to the deskbot and then the bellbot if I talk to her again and say anything except "help" the game hard crashes. No error message. There may be some more responses that don't crash.

[dafioram]

save after talking to desk and bellbot just talk to deskbot again and say something besides help

[dreammaster]

Hmm.. I'm having trouble replicating the problem, even using your savegame. What's specific examples of stuff you entered that crashed?

[dafioram]

I bet you'r not using windows.

See the video here: ​http://sendvid.com/3s9t0qos

[dreammaster]

I am actually. Maybe it was because I'm using a Visual Studio development environment rather than a daily build. In any case, I was able to replicate a crash using "upgrade my room", which I've fixed. So hopefully this will have fixed the crash you experienced as well.

[dafioram]

This crash is still present 1.10.0git-3766-gb0ecbc9 (July 10) even if I say "upgrade my room". Are you using the GOG versions?

I started from the beginning of the game and didn't use a previous saved game.

[wjp]

The problem might be that TTquotesTree::search seems to expect its TTtreeResult *buffer to be a buffer of multiple TTtreeResult objects. (Since search1 happily access buffer + 1 and further by recursing.)

DeskbotScript::searchQuotes() calls it with only a single TTtreeResult object.

Other functions seem to call it with a similar pattern.

Valgrind points at two more suspicious things here, although I suspect the one above is the actual culprit: CWaveFile::audioStream tells the MemoryReadStream to dispose of _waveData at end with free, even though it is allocated with new[]. And TTparser::filterConcepts accesses deleted data when doing currP = currP->_nextP after deleting currP in removeConcept(currP).

[dreammaster]

I've fixed the bugs that wjp helpfully pointed out. If you could test on tomorrow's daily build, and see if it fixes the crash. Thanks.