assertion failed during play

[OznOg]

using 0626d4f on fedora 37, build myself

I was casually playing then the game crashed. Hopefully, I was able to reproduce the crash while running in gdb it reports

OpenDUNE/src/pool/structure.c

Structure *Structure_Get_ByIndex(uint16 index)
{
        assert(index < STRUCTURE_INDEX_MAX_HARD);
        return &g_structureArray[index];
}

value index being STRUCTURE_INDEX_MAX_HARD

the lib sanitizer also report the defect:

$ ./bin/opendune
No valid MIDI output ports.
  Please install and start Timidity++ like: timidity -iA
String_Load(PROTECT) filling 940 0x9643
Useless GFX_SetPalette() call
s_timer_count = 48
Useless GFX_SetPalette() call
[SCRIPT] Stack Overflow; Type: Unit; Index: 12; Type: 20;
=================================================================
==91231==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000005b679c at pc 0x0000004976ca bp 0x7ffef98befe0 sp 0x7ffef98befd8
WRITE of size 2 at 0x0000005b679c thread T0
    #0 0x4976c9 in Structure_Destroy (OpenDUNE/build/bin/opendune+0x4976c9)
    #1 0x497680 in Structure_Destroy (OpenDUNE/build/bin/opendune+0x497680)
    #2 0x497ae0 in Structure_Damage (OpenDUNE/build/bin/opendune+0x497ae0)
    #3 0x4afb1c in Unit_Move (OpenDUNE/build/bin/opendune+0x4afb1c)
    #4 0x4b153b in GameLoop_Unit (OpenDUNE/build/bin/opendune+0x4b153b)
    #5 0x414c8e in main (OpenDUNE/build/bin/opendune+0x414c8e)
    #6 0x7f135e87554f in __libc_start_call_main (/lib64/libc.so.6+0x2754f)
    #7 0x7f135e875608 in __libc_start_main_impl (/lib64/libc.so.6+0x27608)
    #8 0x4191f4 in _start (OpenDUNE/build/bin/opendune+0x4191f4)

0x0000005b679c is located 4 bytes to the left of global variable 'g_teamFindCount' defined in 'OpenDUNE/src/pool/team.c:16:15' (0x5b67a0) of size 2
0x0000005b679c is located 44 bytes to the right of global variable 'g_structureArray' defined in 'OpenDUNE/src/pool/structure.c:16:25' (0x5b4620) of size 8528
SUMMARY: AddressSanitizer: global-buffer-overflow (OpenDUNE/build/bin/opendune+0x4976c9) in Structure_Destroy
Shadow bytes around the buggy address:
  0x0000800aeca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800aecb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800aecc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800aecd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800aece0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
=>0x0000800aecf0: f9 f9 f9[f9]02 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0000800aed00: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
  0x0000800aed10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800aed20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800aed30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800aed40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==91231==ABORTING

[OznOg]

crash_sav.zip
I have a sav file that is a few seconds before it usually happen

[OznOg]

So the reason sesms obvious, array is indexed off by one, but I don't really know what is the reason for this bad index....

[OznOg]

Thread 1 "opendune" hit Breakpoint 1, Structure_Get_ByIndex (index=82) at OpenDUNE/src/pool/structure.c:28
28 assert(index < STRUCTURE_INDEX_MAX_HARD);
(gdb) p (int)STRUCTURE_INDEX_MAX_HARD
$1 = 82
(gdb)