Skip to content

bugfix(saveload): Fix aircraft carrier ramp state serialized out of bounds#2997

Merged
xezon merged 1 commit into
TheSuperHackers:mainfrom
bobtista:bobtista/bugfix/flightdeck-rampup-out-of-bounds
Jul 26, 2026
Merged

bugfix(saveload): Fix aircraft carrier ramp state serialized out of bounds#2997
xezon merged 1 commit into
TheSuperHackers:mainfrom
bobtista:bobtista/bugfix/flightdeck-rampup-out-of-bounds

Conversation

@bobtista

@bobtista bobtista commented Jul 21, 2026

Copy link
Copy Markdown

Fixes #2995

FlightDeckBehavior::xfer serializes the launch ramp state with xfer->xferBool( &m_rampUp[ MAX_RUNWAYS ] ) inside the for ( i = 0; i < MAX_RUNWAYS; i++ ) loop. m_rampUp is Bool[ MAX_RUNWAYS ] and the last member of the class, so indexing it with the constant MAX_RUNWAYS reads and writes one element past the array on every save and load. The real m_rampUp[0]/m_rampUp[1] are never saved or restored, so on load the ramp state reverts to its constructed value and the launch sequence can replay.

Now the ramp state is indexed by the loop variable i. This does not change the save layout (same two bools), so existing saves still load.

Todo:

  • Replicate to Generals N/A, FlightDeckBehavior (Aircraft Carrier) is Zero Hour only

@bobtista bobtista self-assigned this Jul 21, 2026
@bobtista bobtista added the Bug Something is not working right, typically is user facing label Jul 21, 2026
@greptile-apps

greptile-apps Bot commented Jul 21, 2026

Copy link
Copy Markdown

Greptile Summary

This PR fixes aircraft carrier ramp-state serialization in Zero Hour. The main changes are:

  • Uses the runway loop index when serializing m_rampUp.
  • Stops reading and writing one element past the ramp-state array.
  • Adds an inline note explaining the bounds fix.

Confidence Score: 4/5

The old-save loading path can misapply stale ramp-state bytes.

  • New saves use the correct ramp-state array element.
  • Existing saves still contain the previous out-of-bounds bool data in those stream slots.
  • Loading those saves can turn that stale data into live carrier ramp state.

GeneralsMD/Code/GameEngine/Source/GameLogic/Object/Behavior/FlightDeckBehavior.cpp

Important Files Changed

Filename Overview
GeneralsMD/Code/GameEngine/Source/GameLogic/Object/Behavior/FlightDeckBehavior.cpp Updates ramp-state save/load indexing from the out-of-bounds constant index to the active runway index.
Prompt To Fix All With AI
Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
GeneralsMD/Code/GameEngine/Source/GameLogic/Object/Behavior/FlightDeckBehavior.cpp:1705
**Old Saves Load Garbage Ramp State**

When a save created before this change is loaded, the two bool slots still contain bytes that were saved from `m_rampUp[MAX_RUNWAYS]`, not from the real ramp flags. This line now copies those stale bytes into `m_rampUp[i]`, so existing saves can load with a runway ramp incorrectly marked up and alter carrier launch or ramp sequencing.

Reviews (1): Last reviewed commit: "bugfix(savegame): Fix aircraft carrier r..." | Re-trigger Greptile

@Caball009 Caball009 added Minor Severity: Minor < Major < Critical < Blocker ZH Relates to Zero Hour Saveload Is Saveload/Xfer related labels Jul 21, 2026
@xezon xezon changed the title bugfix(savegame): Fix aircraft carrier ramp state serialized out of bounds bugfix(saveload): Fix aircraft carrier ramp state serialized out of bounds Jul 24, 2026

@xezon xezon left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good

@xezon
xezon merged commit 070053c into TheSuperHackers:main Jul 26, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Bug Something is not working right, typically is user facing Minor Severity: Minor < Major < Critical < Blocker Saveload Is Saveload/Xfer related ZH Relates to Zero Hour

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Aircraft Carrier ramp state is serialized out of bounds

3 participants