FL system crash NAVmap

cata123

Hello.
Recently i started remake original systems, expanding them with RimShot’s scale tool, but I had a problem with NY.
Reworked system paths and finally the trade lane rings that obviousely were too rare, you couldn’t make a waypoint that includes TLR and I recreated them with FLE, and edited.
Problem is the game (not the server) crash only when opening NAV map, without an error or warning on FLSpew (not tested in SP). And sometimes I observed some texture changes before crash (like expanding the TLR like a triangle, still with animation).
I tested even with just a set of trade lanes, and with the same result.
Note that new jumgates or jumpholes were not added, only increased zones size, adjusting patrol paths, increased sun and planets, and finally the TLR, all were made in FL Mod Studio, text editor and FLE for trade lanes.
I know there is a limit for the maximum objects in a system, not really sure if i’s reached here and how the client or server would crash.
But there is any way to change the maximum numbers of objects in space ?

adoxa

A crash offset would help (check the Event Viewer).

cata123

Ok, recorded as this:

Log Name:      Application
Source:        Application Error
Date:          05-11-15 19:49:38
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Phenom2X4
Description:
Faulting application name: Freelancer.exe, version: 2.5.1223.11, time stamp: 0x00534d69
Faulting module name: ntdll.dll, version: 6.1.7601.23002, time stamp: 0x5507b138
Exception code: 0xc0000005
Fault offset: 0x00037b61
Faulting process id: 0xd70
Faulting application start time: 0x01d117f213fab065
Faulting application path: D:\Freelancer\EXE\Freelancer.exe
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: 953c145c-83e5-11e5-b1ab-0023543a046b
Event Xml:
 <event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><system><provider name="Application Error"><eventid qualifiers="0">1000</eventid>
    <level>2</level>
    <task>100</task>
    <keywords>0x80000000000000</keywords>
    <timecreated systemtime="2015-11-05T17:49:38.000000000Z"><eventrecordid>65505</eventrecordid>
    <channel>Application</channel>
    <computer>Phenom2X4</computer></timecreated></provider></system> 
  <eventdata><data>Freelancer.exe</data>
    <data>2.5.1223.11</data>
    <data>00534d69</data>
    <data>ntdll.dll</data>
    <data>6.1.7601.23002</data>
    <data>5507b138</data>
    <data>c0000005</data>
    <data>00037b61</data>
    <data>d70</data>
    <data>01d117f213fab065</data>
    <data>D:\Freelancer\EXE\Freelancer.exe</data>
    <data>C:\Windows\SysWOW64\ntdll.dll</data>
    <data>953c145c-83e5-11e5-b1ab-0023543a046b</data></eventdata></event>

? Offline

ntdll.dll crashes - Not supported parameter or typing error, not supported/equipable archetype in players char file.

cata123

What parameters ? Could be in system too ?
In system, new stuff are just Manhattan retextured and bigger sun.
The system change did not made a crash untill adding last recreated tradelanes.
And as equipment, nothing extra “custom” except engclass plugin for engines and powerplants.

adoxa

Yeah, that wasn’t as helpful as I’d hoped. Probably is memory overflow, but I’d need the system itself to test.

? Offline

@cata123 i think at the *.fl chat file.
Try to recreate clean *.fl without "Visit = "

cata123

@adoxa : sure, test it. As changed archetypes, all planets have changed, also the sun, and added some space stations parts.
@heloween : I deleted some visits, forgot to mention that i have also the visit = 128 to the sun, some offset descovered by adoxa that hides the giant sun, and i had to remove from player file visit because of a mistake.
And clean .fl means new player or player with visits deleted ?

? Offline

Sure, mpnewcharacter.fl or newplayer.fl without visits

cata123

With new character or with all visits deleted or new character still crash, but at another offset :

Log Name:      Application
Source:        Application Error
Date:          07-11-15 01:48:22
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Phenom2X4
Description:
Faulting application name: Freelancer.exe, version: 2.5.1223.11, time stamp: 0x00534d69
Faulting module name: ntdll.dll, version: 6.1.7601.23002, time stamp: 0x5507b138
Exception code: 0xc0000005
Fault offset: 0x0002e30e
Faulting process id: 0x1488
Faulting application start time: 0x01d118ed8b4857d9
Faulting application path: D:\Freelancer\EXE\Freelancer.exe
Faulting module path: C:\Windows\SysWOW64\ntdll.dll
Report Id: dcabc385-84e0-11e5-b94f-0023543a046b
Event Xml:
 <event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><system><provider name="Application Error"><eventid qualifiers="0">1000</eventid>
    <level>2</level>
    <task>100</task>
    <keywords>0x80000000000000</keywords>
    <timecreated systemtime="2015-11-06T23:48:22.000000000Z"><eventrecordid>65615</eventrecordid>
    <channel>Application</channel>
    <computer>Phenom2X4</computer></timecreated></provider></system> 
  <eventdata><data>Freelancer.exe</data>
    <data>2.5.1223.11</data>
    <data>00534d69</data>
    <data>ntdll.dll</data>
    <data>6.1.7601.23002</data>
    <data>5507b138</data>
    <data>c0000005</data>
    <data>0002e30e</data>
    <data>1488</data>
    <data>01d118ed8b4857d9</data>
    <data>D:\Freelancer\EXE\Freelancer.exe</data>
    <data>C:\Windows\SysWOW64\ntdll.dll</data>
    <data>dcabc385-84e0-11e5-b94f-0023543a046b</data></eventdata></event>

adoxa

There’s an assumed limit of 128 trade lane rings, which you exceed, thus buffer overflow causes memory corruption.

Freelancer.exe	08E46B	60->C0 = allow up to 256 trade lane rings ~adoxa

```The exact value is an integer one byte earlier: 192 * number of [c]prev_ring[/c] (or [c]next_ring[/c], or [c]Archetype = Trade_Lane_Ring[/c] - [c]tradelane_space_name[/c] / 2).

cata123

Amaizing. This was it. Now works normal. Hard to belive that nobody tried >128 TLR.
Thanks adoxa & helloween.