AddressSanitizer and valgrind fixes from Ryan's 2020 Descent 3 build...

d3-asan.diff

commit ee39d8b93ac9c70f7ef11ada3f684d26c9135bd4
Author: Ryan C. Gordon <icculus@icculus.org>
Date:   Sun Jun 9 00:18:36 2019 -0400

    Some initial fixes from AddressSanitizer.

diff --git a/Main/ddio_lnx/lnxfile.cpp b/Main/ddio_lnx/lnxfile.cpp
index 2d9ecb0..de35fe8 100644
--- a/Main/ddio_lnx/lnxfile.cpp
+++ b/Main/ddio_lnx/lnxfile.cpp
@@ -275,13 +275,13 @@ void ddio_MakePath(char* newPath, const char* absolutePathHeader, const char* su
   ASSERT(absolutePathHeader);
   ASSERT(subDir);
   
-  if (newPath != absolutePathHeader){
+  if (strcmp(newPath, absolutePathHeader) != 0) {
     strcpy(newPath, absolutePathHeader);
   }
 
   // Add the first sub directory
   pathLength = strlen(newPath);
-  if (newPath[pathLength - 1] != delimiter){
+  if ((pathLength > 0) && newPath[pathLength - 1] != delimiter){
     newPath[pathLength] = delimiter;	 // add the delimiter
     newPath[pathLength+1] = 0;         // terminate the string
   }
diff --git a/Main/terrain.cpp b/Main/terrain.cpp
index b81c5a8..f4cd1d4 100644
--- a/Main/terrain.cpp
+++ b/Main/terrain.cpp
@@ -29,8 +29,9 @@
 // How far we can see (in world coordinates)
 float VisibleTerrainZ;
 
-terrain_segment Terrain_seg[TERRAIN_WIDTH*TERRAIN_DEPTH];
-terrain_tex_segment Terrain_tex_seg[TERRAIN_TEX_WIDTH*TERRAIN_TEX_DEPTH];
+// added "* 2" because we are overflowing these arrays in GenerateLODDeltas.  --ryan, 2019.
+terrain_segment Terrain_seg[TERRAIN_WIDTH*TERRAIN_DEPTH*2];
+terrain_tex_segment Terrain_tex_seg[TERRAIN_TEX_WIDTH*TERRAIN_TEX_DEPTH*2];
 terrain_sky Terrain_sky;
 
 #if (!defined(RELEASE) || defined(NEWEDITOR))
diff --git a/Main/ui/UIRes.cpp b/Main/ui/UIRes.cpp
index f4fe24f..98685eb 100644
--- a/Main/ui/UIRes.cpp
+++ b/Main/ui/UIRes.cpp
@@ -153,13 +153,13 @@ const UITextItem& UITextItem::operator =(const UITextItem& item)
 		m_Text = mem_strdup(item.m_Text);
 		if (!m_Text) 
 			Error("Memory allocation failed in UITextItem.");
+	    strcpy(m_Text, item.m_Text);
 	}
 	else {
 		m_Text = &UITextItem::dummy_str[0];
 		dummy_str[0] = 0;
 	}
 
-	strcpy(m_Text, item.m_Text);
 	m_Color = item.m_Color;
 	m_Alpha = item.m_Alpha;
 	m_Font = item.m_Font;
commit 2400113892c1b0052110c11fd4cd0494d9076850
Author: Ryan C. Gordon <icculus@icculus.org>
Date:   Thu Jun 13 09:10:30 2019 -0400

    A bunch of AddressSanitizer fixes.

diff --git a/Main/AIGoal.cpp b/Main/AIGoal.cpp
index a803761..0223714 100644
--- a/Main/AIGoal.cpp
+++ b/Main/AIGoal.cpp
@@ -795,31 +795,34 @@ void GoalDoFrame(object *obj)
 					posp = &goal_obj->pos;
 					roomnum = goal_obj->roomnum;
 
-					float dist = vm_VectorDistance(&AIDynamicPath[ai_info->path.num_paths - 1].pos[ai_info->path.path_end_node[ai_info->path.num_paths - 1]], posp);
-
-					if(dist < 5.0f && ai_info->path.num_paths != 0)
+					if (ai_info->path.num_paths > 0)
 					{
-						int obj_room = BOA_INDEX(obj->roomnum);
-						int path_room = BOA_INDEX(AIDynamicPath[ai_info->path.cur_path].roomnum[ai_info->path.cur_node]);
-						vector path_pos = AIDynamicPath[ai_info->path.cur_path].pos[ai_info->path.cur_node];
+						const float dist = vm_VectorDistance(&AIDynamicPath[ai_info->path.num_paths - 1].pos[ai_info->path.path_end_node[ai_info->path.num_paths - 1]], posp);
 
-						if(obj_room != path_room)
+						if(dist < 5.0f)
 						{
-							fvi_query fq;
-							fvi_info	hit_info;
-							
-							fq.p0					= &obj->pos;
-							fq.startroom		= obj->roomnum; 
-							fq.p1					= &path_pos;
-							fq.rad					= obj->size / 4.0f;
-							fq.thisobjnum			= OBJNUM(obj);
-							fq.ignore_obj_list	= NULL;
-							fq.flags				= FQ_CHECK_OBJS | FQ_NO_RELINK | FQ_IGNORE_NON_LIGHTMAP_OBJECTS;
+							int obj_room = BOA_INDEX(obj->roomnum);
+							int path_room = BOA_INDEX(AIDynamicPath[ai_info->path.cur_path].roomnum[ai_info->path.cur_node]);
+							vector path_pos = AIDynamicPath[ai_info->path.cur_path].pos[ai_info->path.cur_node];
 
-							if(fvi_FindIntersection(&fq, &hit_info) == HIT_NONE)
+							if(obj_room != path_room)
 							{
-								mprintf((0, "AI OBJ Path: No need to update the path for obj %d\n", OBJNUM(obj)));
-								f_make_path = false;
+								fvi_query fq;
+								fvi_info	hit_info;
+							
+								fq.p0					= &obj->pos;
+								fq.startroom		= obj->roomnum; 
+								fq.p1					= &path_pos;
+								fq.rad					= obj->size / 4.0f;
+								fq.thisobjnum			= OBJNUM(obj);
+								fq.ignore_obj_list	= NULL;
+								fq.flags				= FQ_CHECK_OBJS | FQ_NO_RELINK | FQ_IGNORE_NON_LIGHTMAP_OBJECTS;
+
+								if(fvi_FindIntersection(&fq, &hit_info) == HIT_NONE)
+								{
+									mprintf((0, "AI OBJ Path: No need to update the path for obj %d\n", OBJNUM(obj)));
+									f_make_path = false;
+								}
 							}
 						}
 					}
@@ -837,31 +840,34 @@ void GoalDoFrame(object *obj)
 				posp = &cur_goal->g_info.pos;
 				roomnum = cur_goal->g_info.roomnum;
 
-				float dist = vm_VectorDistance(&AIDynamicPath[ai_info->path.num_paths - 1].pos[ai_info->path.path_end_node[ai_info->path.num_paths - 1]], posp);
-
-				if(dist < 5.0f && ai_info->path.num_paths != 0)
+				if (ai_info->path.num_paths > 0)
 				{
-					int obj_room = BOA_INDEX(obj->roomnum);
-					int path_room = BOA_INDEX(AIDynamicPath[ai_info->path.cur_path].roomnum[ai_info->path.cur_node]);
-					vector path_pos = AIDynamicPath[ai_info->path.cur_path].pos[ai_info->path.cur_node];
+					const float dist = vm_VectorDistance(&AIDynamicPath[ai_info->path.num_paths - 1].pos[ai_info->path.path_end_node[ai_info->path.num_paths - 1]], posp);
 
-					if(obj_room != path_room)
+					if(dist < 5.0f)
 					{
-						fvi_query fq;
-						fvi_info	hit_info;
-						
-						fq.p0					= &obj->pos;
-						fq.startroom		= obj->roomnum; 
-						fq.p1					= &path_pos;
-						fq.rad					= obj->size / 4.0f;
-						fq.thisobjnum			= OBJNUM(obj);
-						fq.ignore_obj_list	= NULL;
-						fq.flags				= FQ_CHECK_OBJS | FQ_NO_RELINK | FQ_IGNORE_NON_LIGHTMAP_OBJECTS;
-
-						if(fvi_FindIntersection(&fq, &hit_info) == HIT_NONE)
+						int obj_room = BOA_INDEX(obj->roomnum);
+						int path_room = BOA_INDEX(AIDynamicPath[ai_info->path.cur_path].roomnum[ai_info->path.cur_node]);
+						vector path_pos = AIDynamicPath[ai_info->path.cur_path].pos[ai_info->path.cur_node];
+
+						if(obj_room != path_room)
 						{
-								mprintf((0, "AI POS Path: No need to update the path for obj %d\n", OBJNUM(obj)));
-							f_make_path = false;
+							fvi_query fq;
+							fvi_info	hit_info;
+							
+							fq.p0					= &obj->pos;
+							fq.startroom		= obj->roomnum; 
+							fq.p1					= &path_pos;
+							fq.rad					= obj->size / 4.0f;
+							fq.thisobjnum			= OBJNUM(obj);
+							fq.ignore_obj_list	= NULL;
+							fq.flags				= FQ_CHECK_OBJS | FQ_NO_RELINK | FQ_IGNORE_NON_LIGHTMAP_OBJECTS;
+
+							if(fvi_FindIntersection(&fq, &hit_info) == HIT_NONE)
+							{
+									mprintf((0, "AI POS Path: No need to update the path for obj %d\n", OBJNUM(obj)));
+								f_make_path = false;
+							}
 						}
 					}
 				}
diff --git a/Main/module/module.cpp b/Main/module/module.cpp
index fe02255..78802c3 100644
--- a/Main/module/module.cpp
+++ b/Main/module/module.cpp
@@ -232,7 +232,7 @@ void dd_SplitPath(const char* srcPath, char* path, char* filename, char* ext)
   // Check for an extension
   ///////////////////////////////////////
   int t = totalLen - 1;
-  while( (srcPath[t]!='.') && (srcPath[t]!='/') && (t>=0) ) t--;
+  while( (t>=0) && (srcPath[t]!='.') && (srcPath[t]!='/') ) t--;
   //see if we are at an extension
   if((t>=0)&&(srcPath[t]=='.')){
     //we have an extension
@@ -252,7 +252,7 @@ void dd_SplitPath(const char* srcPath, char* path, char* filename, char* ext)
   // Check for file name
   ////////////////////////////////////
   int temp = (extStart!=-1)?(extStart):(totalLen-1);
-  while( (srcPath[temp]!='/') && (temp>=0) ) temp--;
+  while( (temp>=0) && (srcPath[temp]!='/') ) temp--;
   if(temp<0)
     temp = 0;
   if(srcPath[temp]=='/'){
diff --git a/Main/physics/FindIntersection.cpp b/Main/physics/FindIntersection.cpp
index 0b0c066..9b9f953 100644
--- a/Main/physics/FindIntersection.cpp
+++ b/Main/physics/FindIntersection.cpp
@@ -2194,7 +2194,7 @@ int fvi_QuickDistObjectList(vector *pos, int init_room_index, float rad, short *
 				{
 					if(num_objects >= max_elements) break;
 
-					if((f_include_non_collide_objects) || CollisionRayResult[Objects[cur_obj_index].type] != RESULT_NOTHING)
+					if((f_include_non_collide_objects) || ((Objects[cur_obj_index].type != OBJ_NONE) && (CollisionRayResult[Objects[cur_obj_index].type] != RESULT_NOTHING)))
 					{
 						if(!f_only_players_and_ais || Objects[cur_obj_index].type == OBJ_PLAYER || Objects[cur_obj_index].ai_info)
 						{
@@ -2224,7 +2224,7 @@ int fvi_QuickDistObjectList(vector *pos, int init_room_index, float rad, short *
 		{
 			if(num_objects >= max_elements) break;
 			
-			if((f_include_non_collide_objects) || CollisionRayResult[Objects[x].type] != RESULT_NOTHING)
+			if((f_include_non_collide_objects) || ((Objects[x].type != OBJ_NONE) && (CollisionRayResult[Objects[x].type] != RESULT_NOTHING)))
 			{
 				if(!f_only_players_and_ais || Objects[x].type == OBJ_PLAYER || Objects[x].ai_info)
 				{
@@ -2272,7 +2272,7 @@ int fvi_QuickDistObjectList(vector *pos, int init_room_index, float rad, short *
 			while(cur_obj_index > -1)
 			{
 				if(num_objects >= max_elements) break;
-				if((f_include_non_collide_objects) || CollisionRayResult[Objects[cur_obj_index].type] != RESULT_NOTHING)
+				if((f_include_non_collide_objects) || ((Objects[cur_obj_index].type != OBJ_NONE) && (CollisionRayResult[Objects[cur_obj_index].type] != RESULT_NOTHING)))
 				{
 					if(!f_only_players_and_ais || Objects[cur_obj_index].type == OBJ_PLAYER || Objects[cur_obj_index].ai_info)
 					{
@@ -4660,7 +4660,7 @@ inline int GetFaceAlpha(face *fp,int bm_handle)
 			ret |= ATF_VERTEX;
 
 		//Check for transparency
-		if (GameBitmaps[bm_handle].format!=BITMAP_FORMAT_4444 && GameTextures[fp->tmap].flags & TF_TMAP2)
+		if ((bm_handle >= 0) && (GameBitmaps[bm_handle].format!=BITMAP_FORMAT_4444) && (GameTextures[fp->tmap].flags & TF_TMAP2))
 				ret |= ATF_TEXTURE;
 	}
 
diff --git a/Main/postrender.cpp b/Main/postrender.cpp
index 54fd62e..6ccb748 100644
--- a/Main/postrender.cpp
+++ b/Main/postrender.cpp
@@ -104,11 +104,12 @@ static int Postrender_sort_func(const postrender_struct *a, const postrender_str
 void SortPostrenders ()
 {
 	postrender_struct v,t;
+    const int maxidx = Num_postrenders-1;
 	int pop_val;
 	int i,j;
 	int l,r;
 	l=0;
-	r=Num_postrenders-1;
+	r=maxidx;
 
 	ushort state_stack_counter=0;
 	ushort state_stack[MAX_POSTRENDERS];
@@ -123,10 +124,10 @@ void SortPostrenders ()
 			v=Postrender_list[r];
 			while (1)
 			{
-				while (Postrender_list[++i].z < v.z)
+				while ((i < maxidx) && (Postrender_list[++i].z < v.z))
 					;
 
-				while (Postrender_list[--j].z > v.z)
+				while ((j > 0) && (Postrender_list[--j].z > v.z))
 					;
 
 				if (i>=j)
diff --git a/Main/render.cpp b/Main/render.cpp
index 36dac01..6d0af9f 100644
--- a/Main/render.cpp
+++ b/Main/render.cpp
@@ -5090,11 +5090,12 @@ void FogClipPoints (g3Point *on_pnt,g3Point *off_pnt,g3Point *dest,float zval,in
 void SortStates (state_limited_element *state_array,int cellcount)
 {
 	state_limited_element v,t;
+    const int maxidx = cellcount-1;
 	int pop_val;
 	int i,j;
 	int l,r;
 	l=0;
-	r=cellcount-1;
+	r=maxidx;
 	ushort state_stack_counter=0;
 	ushort state_stack[2000];
 	
@@ -5107,9 +5108,9 @@ void SortStates (state_limited_element *state_array,int cellcount)
 			v=state_array[r];
 			while (1)
 			{
-				while (state_array[++i].sort_key < v.sort_key)
+				while ((i < maxidx) && (state_array[++i].sort_key < v.sort_key))
 					;
-				while (state_array[--j].sort_key > v.sort_key)
+				while ((j > 0) && (state_array[--j].sort_key > v.sort_key))
 					;
 				if (i>=j)
 					break;
diff --git a/Main/scorch.cpp b/Main/scorch.cpp
index 70736c4..0f8a8c9 100644
--- a/Main/scorch.cpp
+++ b/Main/scorch.cpp
@@ -130,7 +130,7 @@ int Scorch_texture_handles[MAX_SCORCH_TEXTURES];
 //Called when a new level is started to reset the scorch list
 void ResetScorches()
 {
-	Scorch_start = Scorch_end = -1;
+	Scorch_start = Scorch_end = 0;
 }
 
 //Delete the specified scorch mark
@@ -242,8 +242,8 @@ void AddScorch(int roomnum,int facenum,vector *pos,int texture_handle,float size
 			Scorch_start = 0;
 	}
 	Scorch_end = new_end;
-	if (Scorch_start == -1)
-		Scorch_start = 0;
+
+    ASSERT(Scorch_start >= 0);
 
 	//Get a pointer to our struct
 	sp = &Scorches[Scorch_end];
diff --git a/Main/scripts/linux_lib.cpp b/Main/scripts/linux_lib.cpp
index 8212692..56bc39d 100644
--- a/Main/scripts/linux_lib.cpp
+++ b/Main/scripts/linux_lib.cpp
@@ -20,7 +20,7 @@ void _splitpath(const char *srcPath,char *drive,char *path,char *filename,char *
   	// Check for an extension
   	///////////////////////////////////////
   	int t = totalLen - 1;
-  	while( (srcPath[t]!='.') && (srcPath[t]!='/') && (t>=0) ) t--;
+  	while( (t>=0) && (srcPath[t]!='.') && (srcPath[t]!='/') ) t--;
   	//see if we are at an extension
   	if((t>=0)&&(srcPath[t]=='.')){
   		//we have an extension
@@ -40,7 +40,7 @@ void _splitpath(const char *srcPath,char *drive,char *path,char *filename,char *
   	// Check for file name
   	////////////////////////////////////
   	int temp = (extStart!=-1)?(extStart):(totalLen-1);
- 	while( (srcPath[temp]!='/') && (temp>=0) ) temp--;
+ 	while( (temp>=0) && (srcPath[temp]!='/') ) temp--;
   	if(temp<0)
     	temp = 0;
   	if(srcPath[temp]=='/'){
diff --git a/Main/sndlib/hlsoundlib.cpp b/Main/sndlib/hlsoundlib.cpp
index 2f193ce..17427fb 100644
--- a/Main/sndlib/hlsoundlib.cpp
+++ b/Main/sndlib/hlsoundlib.cpp
@@ -962,6 +962,9 @@ bool hlsSystem::ComputePlayInfo(int sound_obj_index, vector *virtual_pos, vector
 		sound_seg = m_sound_objects[sound_obj_index].m_link_info.pos_info.segnum;
 	}
 
+	if (sound_seg == -1)
+		return false;
+
 	sound_seg = BOA_INDEX(sound_seg);
 	ear_seg = BOA_INDEX(Viewer_object->roomnum);
 	if(!BOA_IsSoundAudible(sound_seg, ear_seg))
commit aaa380108ad26b39782a520f3a4aeae7315dba9e
Author: Ryan C. Gordon <icculus@icculus.org>
Date:   Wed Jun 19 02:23:07 2019 -0400

    A bunch of AddressSanitizer fixes.

diff --git a/Main/Player.cpp b/Main/Player.cpp
index 70243ab..5c91f8a 100644
--- a/Main/Player.cpp
+++ b/Main/Player.cpp
@@ -1359,7 +1359,7 @@ int PlayerGetRandomStartPosition (int slot)
 			}
 			else
 			{
-				objnum=Terrain_seg[Players[num].start_roomnum].objects;
+				objnum=Terrain_seg[CELLNUM(Players[num].start_roomnum)].objects;
 			}
 			int bad=0;
 			for (;objnum!=-1 && !bad;objnum=Objects[objnum].next)
diff --git a/Main/ddio_lnx/lnxfile.cpp b/Main/ddio_lnx/lnxfile.cpp
index de35fe8..2a6a595 100644
--- a/Main/ddio_lnx/lnxfile.cpp
+++ b/Main/ddio_lnx/lnxfile.cpp
@@ -138,7 +138,7 @@ void ddio_SplitPath(const char* srcPath, char* path, char* filename, char* ext)
   // Check for an extension
   ///////////////////////////////////////
   int t = totalLen - 1;
-  while( (srcPath[t]!='.') && (srcPath[t]!='/') && (t>=0) ) t--;
+  while( (t>=0) && (srcPath[t]!='.') && (srcPath[t]!='/') ) t--;
   //see if we are at an extension
   if((t>=0)&&(srcPath[t]=='.')){
     //we have an extension
diff --git a/Main/lib/mdllinit.h b/Main/lib/mdllinit.h
index 736b1a6..efa781e 100644
--- a/Main/lib/mdllinit.h
+++ b/Main/lib/mdllinit.h
@@ -292,8 +292,8 @@
 	DLLUse_DirectPlay = (bool *)API.vp[22];
 	#endif
 	DLLDedicated_server = (bool *)API.vp[25];
-	DLLTCP_active = (BOOL)*API.vp[26];
-	DLLIPX_active = (BOOL)*API.vp[27];
+	DLLTCP_active = *((BOOL *)(API.vp[26]));
+	DLLIPX_active = *((BOOL *)(API.vp[27]));
 	DLLnw_ListenPort = (unsigned short)(size_t)API.vp[28];
 	DLLMulti_Gamelist_changed = (bool *)API.vp[29];
 	DLLPXO_hosted_lobby_name = (char *)API.vp[30];
diff --git a/Main/multi_dll_mgr.cpp b/Main/multi_dll_mgr.cpp
index 9f06eda..25aca90 100644
--- a/Main/multi_dll_mgr.cpp
+++ b/Main/multi_dll_mgr.cpp
@@ -1214,8 +1214,7 @@ void NewUIWindowLoadBackgroundImage(NewUIWindow * item,const char *image_name)
 }
 void DeleteUIItem(void *delitem)
 {
-	
-	delete (UIItem *) delitem;
+	delete delitem;
 }
 void GadgetDestroy(UIGadget *item)
 {
diff --git a/Main/networking/networking.cpp b/Main/networking/networking.cpp
index 7056463..9578990 100644
--- a/Main/networking/networking.cpp
+++ b/Main/networking/networking.cpp
@@ -488,7 +488,7 @@ SOCKET Reliable_IPX_socket = INVALID_SOCKET;
 float first_sent_iamhere = 0;
 float last_sent_iamhere = 0;
 
-unsigned int serverconn = 0xFFFFFFFF;
+int serverconn = -1;
 
 #ifdef WIN32
 #pragma pack(pop,r_udp)
@@ -1524,8 +1524,9 @@ void nw_SendReliableAck(SOCKADDR *raddr,unsigned int sig, network_protocol link_
 	
 	network_address send_address;
 	memset(&send_address,0,sizeof(network_address));
-	
-	send_address.connection_type = reliable_sockets[serverconn].connection_type;
+
+	// this is set below anyhow, but serverconn might be -1 here, so I commented this out.  --ryan, 2019.
+	//send_address.connection_type = reliable_sockets[serverconn].connection_type;
 
     if(NP_TCP==link_type)
 	{
@@ -1613,7 +1614,7 @@ void nw_WorkReliable(ubyte * data,int len,network_address *naddr)
 	
 	reliable_socket *rsocket = NULL;
 	//Check to see if we need to send a packet out.
-	if((reliable_sockets[serverconn].status==RNF_LIMBO) && ((serverconn!=-1)&&(timer_GetTime() - last_sent_iamhere)>NETRETRYTIME) )
+	if( ((serverconn!=-1)&&(timer_GetTime() - last_sent_iamhere)>NETRETRYTIME) && (reliable_sockets[serverconn].status==RNF_LIMBO) )
 	{
 		reliable_header conn_header;
 		//Now send I_AM_HERE packet
commit e5f5664b1c379f2a26f258e10607c8ee224496aa
Author: Ryan C. Gordon <icculus@icculus.org>
Date:   Thu Jun 20 02:18:42 2019 -0400

    Fixed valgrind error.

diff --git a/Main/ddio_lnx/lnxfile.cpp b/Main/ddio_lnx/lnxfile.cpp
index 98c828c..c7a862d 100644
--- a/Main/ddio_lnx/lnxfile.cpp
+++ b/Main/ddio_lnx/lnxfile.cpp
@@ -275,9 +275,9 @@ void ddio_MakePath(char* newPath, const char* absolutePathHeader, const char* su
   ASSERT(absolutePathHeader);
   ASSERT(subDir);
   
-  if (strcmp(newPath, absolutePathHeader) != 0) {
+//  if (strcmp(newPath, absolutePathHeader) != 0) {
     strcpy(newPath, absolutePathHeader);
-  }
+//  }
 
   // Add the first sub directory
   pathLength = strlen(newPath);