C_EquipmentSet.GetItemLocations(Id) crashes the game if the provided Id has 19 items saved in Wrath Classic

It was an off by one error causing an out of bounds write to stack memory that happened to corrupt some stack return guards, so when the function returned, it detected the corruption and called __stack_chk_fail which makes the OS kill the process.

What was going on is certainly “undefined behavior”, and what was going on can certainly cause Windows or x86 Mac to also panic. We just happened to get lucky on PC/x86 Mac with where the compiler put the return guards. It all sort of depends on how much alignment/padding the compiler puts between the last stack variable and the return guards. An out of bounds write a few more or less bytes than we were doing and we’d be crashing on PC instead.

As a side note, we also fixed these kinds of crashes not going through our error reporter on mac, so if this happens again in the future, we should be getting normal crash reports about it now.

3 Likes