Comment 5 for bug 1196251

Revision history for this message
Tormod Volden (tormodvolden) wrote :

Possible off-by-one here, there are only NUM_BONUS_DOTS (4) bonus points, so index 4 is bad:
http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/saucy/xscreensaver/saucy/view/head:/hacks/pacman_level.c#L542
(and on line 556)

The array of bonus_dot bonus_dots[NUM_BONUS_DOTS] is defined on http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/saucy/xscreensaver/saucy/view/head:/hacks/pacman.h#L221

Suggestion for patch: replace <= with < on lines 542 and 556.

BTW, I wonder if the stack is messed up. The stacktrace says:
#0 is_bonus_dot (pp=pp@entry=0x1d24780, x=20, y=19, idx=idx@entry=0x7fff5eb693ec) at pacman_level.c:544
        ret = 0
        i = 146321

But the loop variable "i" only goes from 0 to 4. (And should probably only go to 3.)