Strange core crash (ownership, destroy, clearitem)

[Jimmermania 36]

Spoiler

#0  0x29150555 in strlcpy () from /usr/lib32/libc.so.7
No symbol table info available.
#1  0x0811d288 in DESC::Packet (this=this@entry=0x458b10c4,
    c_pvData=c_pvData@entry=0xffff9f0e, iSize=iSize@entry=30)
    at /usr/local/lib/gcc10/include/c++/bits/basic_string.h:194
        p = {bHeader = 3 '\003',
          szName = "\375\000\000\000\000\000\000\000\000\031\002\000\000\305\002                                                                                                                                                             \000\000h\237\377\377\000\263", <incomplete sequence \351\155>, lSize = -24920}
#2  0x0811db19 in DESC::Packet (this=0x458b10c4, c_pvData=0xffff9f0e, iSize=30)
    at desc.cpp:534
        p = <optimized out>
        buf = <optimized out>
#3  0x0812ec9f in FuncPacketAround::operator() (ent=<optimized out>,
    this=<synthetic pointer>) at entity.cpp:74
No locals.
#4  FuncPacketView::operator() (v=..., this=<synthetic pointer>)
    at entity.cpp:85
No locals.
#5  std::for_each<std::__detail::_Node_iterator<std::pair<CEntity* const, int>,                                                                                                                                                              false, false>, FuncPacketView> (__f=..., __last=..., __first=...)
    at /usr/local/lib/gcc10/include/c++/bits/stl_algo.h:3844
No locals.
#6  CEntity::PacketView (this=0x6e252300, data=0xffff9f0e, bytes=30,
--Type <RET> for more, q to quit, c to continue without paging--
    except=0x0) at entity.cpp:103
        f = <optimized out>
#7  0x0812ece1 in CEntity::PacketAround (this=0x6e252300, data=0xffff9f0e, bytes=30, except=0x0) at entity.cpp:91
No locals.
#8  0x0816bc84 in CItem::SetOwnership (iSec=10, ch=0x0, this=0x6e252300) at item.cpp:1413
        p = {bHeader = 31 '\037', dwVID = 2871695360, szName = "\000\350\000\000\000H\251\377\377\352\240\336\375\000H\225P\f\251\377\377x\237\377\377"}
        info = <optimized out>
        p = <optimized out>
        info = <optimized out>
        p = <optimized out>
        p = <optimized out>
#9  CItem::RemoveFromGround (this=0x6e252300) at item.cpp:508
No locals.
#10 0x08178e24 in ITEM_MANAGER::DestroyItem (this=0xffffa90c, item=<optimized out>) at item_manager.cpp:731
        __FUNCTION__ = "DestroyItem"
        it = <optimized out>
        dwID = 242293241
#11 0x080befc3 in CHARACTER::ClearItem (this=0x50954800) at ../../common/singleton.h:24
        i = 201
        item = 0x6e252300
#12 0x080a2091 in CHARACTER::Destroy (this=0x50954800) at char.cpp:613
        party = <optimized out>
#13 0x080a2100 in CHARACTER::~CHARACTER (this=0x50954800, __in_chrg=<optimized out>) at char.cpp:190
No locals.
#14 0x080a266a in CHARACTER::~CHARACTER (this=0x50954800, __in_chrg=<optimized out>) at char.cpp:191
No locals.
#15 0x080a3d36 in CHARACTER::Disconnect (this=0x50954800, c_pszReason=0x852fcb5 "DESC::~DESC") at ../../common/singleton.h:24
        p = {bHeader = 2 '\002', szName = "Combo\000\241\377\3778\000\000\000\272\025\030@v\033\340(\000\220", <incomplete sequence \361\050>}
#16 0x0811ebe9 in DESC::Destroy (this=0x54bd1a00) at desc.cpp:137
No locals.
#17 0x0812393c in DESC_MANAGER::DestroyDesc (this=0xffffad08, d=0x54bd1a00, bEraseFromSet=false) at desc_manager.cpp:454
No locals.
#18 0x0812426b in DESC_MANAGER::DestroyClosed (this=0xffffad08) at desc_manager.cpp:483
        d = 0x54bd1a00
        ci = {<std::__detail::_Node_iterator_base<DESC*, false>> = {_M_cur = 0x41d75008}, <No data fields>}
        i = {<std::__detail::_Node_iterator_base<DESC*, false>> = {_M_cur = 0x50c61590}, <No data fields>}
#19 0x08269d01 in io_loop (fdw=0x2b6b9040) at ../../common/singleton.h:24

 

Hi guys, i have the core crash above. Any ideas why this may happening?
Here are my files:

char_item.cpp: https://pastebin.com/TmkZY7mN
char_battle.cpp: https://pastebin.com/YA1tR36X
item.cpp: https://pastebin.com/UjX9vvmC
item_manager.cpp: https://pastebin.com/dWMeFzkG
entity_view.cpp: https://pastebin.com/JFZKu7tX

Anyone who have a similar error? I would appreciate a help.

[WeedHex 661]

Check about  your #ifdef __ITEM_GROUND_ONLY_OWNER__

Edited January 22 by WeedHex

[mmorse 0xrayz mmorse3399 1143]

Please try to reproduce the crash using the methods below:

• Create a quest with game.drop_item_with_ownership(vnum, count, 1) — so the item is dropped with ownership for 1 sec.
• Stand near it with two clients (players A and B).
• Wait for the ownership to expire (SetOwnership(nullptr) will be called).
• Have player A pick it up at the exact moment it expires.
•     Crash can occur if:
•     The RemoveFromGround() is called.
•     The item is moved into player A's inventory.
•     SetOwnership(nullptr) sends PacketAround while m_pOwner is already set or DESC is gone.

 

• Drop an owned item.
• Right before ownership expires, pick it up and warp/kick the player.
• Player’s DESC* is destroyed, but SetOwnership(nullptr) still sends to old DESC.

 

Try one of those methods.. And let me know if this will crash server

You have to try it lot of times because it might be hard to catch it