Strife spechit access at negative index


Strife modifies projectiles so that they can trigger "impact"-type linedefs, which in Doom were only triggered by the player's tracer-based weapons.

As part of the code which allows this, Strife added a check for special lines having been crossed during the projectile's motion in the function P_XYMovement using the following idiom:

   P_ShootSpecialLine(thing, spechit[numspechit]);

The problem with this code is that numspechit is often left set to the value -1 after a loop is used to run its value down past 0 in order to activate each line that has been crossed. Since the if(numspechit) check only tests that the value is non-zero, -1 is allowed to pass the check and some unrelated memory outside the array is used as a linedef - the program's behavior becomes unpredictable, in theory. Empirical testing seems to indicate that the memory which the vanilla game engine happens to access because of this problem always contains a "special" value which does not equal any of the supported shootable line types, and P_ShootSpecialLine simply returns as a result.

When this code was implemented in the Chocolate Strife project without modification, the game began to crash with an access violation. The if(numspechit) check had to be modified to if(numspechit > 0) in order to preserve the vanilla game engine's level of functionality.