(Potential buffer over-read) Ensure the string g_player[i].wchoice is properly formatted.
This was originally reproduced as a crash in NetDuke32, but may potentially be a problem in EDuke32 as well.
I don't know the exact cause of having wchoice set as described here - could be a random cfg corruption of a known kind - but I had wchoice set to the string "secwd22221" for NetDuke32. EDuke32 also allows this, including a change from the console.
Within P_CheckWeapon
, this can lead to a buffer over-read (or at least, integer shift count overflow). It's possible this was manifested as a crash in NetDuke32 due to the gotweapon
field still being an array, but even with EDuke32's form, this might be a problem.
Edited by NY00123