voltara / fluffos Goto Github PK

void evil()
{
call_out("evil", 0);
}

The above causes an infinite loop because each call_out apply to "evil" gets a new eval_cost budget.

Propose fixing by limiting eval_cost for new immediate call_outs added while processing call_outs.

When applying init() over the destination's inventory, the loop does not check whether a traversed object was moved away. This can result in setup_new_commands proceeding to apply init over the wrong object's inventory. Two problems here: (1) Part of the destination's inventory will not have init() run; (2) Another unrelated object's inventory WILL have init() run.

A fairly straightforward mitigation is to throw an error if (dest != ob->super) for a traversed object.

Evaluation cost is tracked internally by a CPU clock alarm; the eval_cost efun returns an estimate based on elapsed wall time. This can even return negative numbers to the caller. Proposed fix is to add an optional POSIX timers based eval_cost mechanism, and to use timer_gettime() when querying the amount remaining.

setitimer/getitimer is not as suitable because getitimer only has 1/250 second resolution on current versions of Linux, which limits precision when profiling LPC code.

/* find and return a user command */
for (i = 0; i < max_users; i++) {
    ip = all_users[NextCmdGiver++];
    NextCmdGiver %= max_users;

    /* ... */

    /* if there's a command in the buffer, pull it out! */
    if (ip->iflags & CMD_IN_BUF) {
        NextCmdGiver++;
        NextCmdGiver %= max_users;
        user_command = first_cmd_in_buf(ip);
        break;
    }

It is not necessary to increment NextCmdGiver a second time; this allows one user to starve another of command processing time.