yrtria/mod-gold-rush
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: null-session crash on event start/end broadcast #3

Merged
yrtria merged 1 commit from fix/null-session-broadcast-crash into main 2026-09-04 07:51:02 -06:00
Conversation 0 Commits 1 Files changed 1 +4 -3
yrtria commented 2026-09-04 07:44:01 -06:00
Owner
Copy link

Fixes a confirmed crash (symbolized backtrace from a captured coredump on the live server, two crashes in ~24h) caused by ChatHandler(nullptr).SendWorldText(...) in StartEvent()/EndEvent(). ChatHandler::SendWorldText assumes a real session and calls GetSession()->SendPacket() unconditionally -- with a null session that is an immediate null-pointer crash.

Replaced all three call sites with sWorldSessionMgr->SendServerMessage(SERVER_MSG_STRING, text) -- the core-provided session-free broadcast path, same one the built-in .announce GM command uses.

Crash backtrace for reference:

WorldSession::GetPlayer (this=0x0)
WorldSession::SendPacket (this=0x0, ...)
ChatHandler::SendWorldText (...)
GoldRushManager::StartEvent (...) at GoldRush.cpp:880

The EndEvent() call site had not crashed yet but has the identical bug and would fail the first time any event completed naturally rather than being killed by the crash first.

Fixes a confirmed crash (symbolized backtrace from a captured coredump on the live server, two crashes in ~24h) caused by `ChatHandler(nullptr).SendWorldText(...)` in `StartEvent()`/`EndEvent()`. `ChatHandler::SendWorldText` assumes a real session and calls `GetSession()->SendPacket()` unconditionally -- with a null session that is an immediate null-pointer crash. Replaced all three call sites with `sWorldSessionMgr->SendServerMessage(SERVER_MSG_STRING, text)` -- the core-provided session-free broadcast path, same one the built-in `.announce` GM command uses. Crash backtrace for reference: ``` WorldSession::GetPlayer (this=0x0) WorldSession::SendPacket (this=0x0, ...) ChatHandler::SendWorldText (...) GoldRushManager::StartEvent (...) at GoldRush.cpp:880 ``` The `EndEvent()` call site had not crashed yet but has the identical bug and would fail the first time any event completed naturally rather than being killed by the crash first.
yrtria added 1 commit 2026-09-04 07:44:02 -06:00 
StartEvent() and EndEvent() both used ChatHandler(nullptr).SendWorldText()
to announce Gold Rush events server-wide. ChatHandler::SendWorldText()
(core Chat.cpp) unconditionally calls GetSession()->SendPacket() on the
handler's session -- with a null session, that's an immediate null-pointer
dereference. This crashed the live server twice within ~24 hours
(confirmed via a symbolized gdb backtrace against a captured coredump):

  WorldSession::GetPlayer (this=0x0)
  WorldSession::SendPacket (this=0x0, ...)
  ChatHandler::SendWorldText (...)
  GoldRushManager::StartEvent (...) at GoldRush.cpp:880

ChatHandler is meant to wrap a real player/GM session; it was only being
constructed here to reuse SendWorldText's string formatting, with no
actual session behind it.

Fix: use sWorldSessionMgr->SendServerMessage(SERVER_MSG_STRING, text)
instead -- the core-provided, session-free broadcast path (the same one
the built-in .announce GM command uses in cs_message.cpp). No session
required, so no crash regardless of whether the event is triggered
automatically or by a player.

Fixed all three call sites using this broken pattern: the event-start
announcement (two locations -- StartEvent has what looks like an earlier
duplicate/preview announcement plus the main one) and the event-end
announcement in EndEvent(). The EndEvent() site had not crashed yet but
is the exact same bug and would have crashed the first time any event
completed naturally.
yrtria merged commit c2f400a60b into main 2026-09-04 07:51:02 -06:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: yrtria/mod-gold-rush#3
No description provided.
Delete branch "fix/null-session-broadcast-crash"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?