Comment 3 for bug 1639586

Revision history for this message
Frank Birbacher (fbirbacher) wrote :

I took the code from https://salsa.debian.org/games-team/jumpnbump and compiled with the -g flag, set “ulimit -c unlimited” and got a core dump. Looking at it with gdb revealed a call stack ending in “stopchan” from sound.c. There doesn't seem anything obvious here and the only way the code could fail is due to an index out of bounds. Following the call stack up leads to this error:

menu.c:357 calls:
dj_play_sfx(SFX_JUMP, (unsigned short)(SFX_JUMP_FREQ + rnd(2000) - 1000), 64, 0, 0, -1);

The last argument is spelled “-1”, but is passed to a “char” and on this platform “char” is unsigned. This is why we get 255 as a value, and the check in dj_play_sfx fails to protect against this condition:
sound.c:371 condition is always true
    if (channel<0) {

The fix is to use “signed char” as the type. Or maybe just int.