Bug#691107: Line causing the problem

[Jesse Smith]

I have done further testing and, according to gdb, the value of
opts[0].name (the variable which is getting corrupted) is changed in
atanks.cpp, line 1321. This line reads:

if (z == selected_index)
   strcpy(my_pointer, "*");

The intention is to place the '*' character and a trailing NULL
character into the my_pointer string, which is declared as

char my_pointer[2];

The result of this strcpy function should be that my_pointer is assigned
a star and a terminating null. However, for some reason the my_pointer
string appears to be getting clobbered and a long line of garbage is
written to the my_pointer address instead of just "*".

I've also tried assigning the value this way
my_pointer[0] = '*';
my_pointer[1] = '\0';

But the memory corruption still happens. Unless I'm overlooking
something I don't see how writing two bytes to the my_pointer array
could over-write "opts[0].name". Again, if I compile Atanks using GCC
4.6 or Clang, then this memory corruption doesn't happen. The my_pointer
variable gets its proper string of "*" and opts[0].name is maintained
with the proper value of "Physics".

I've been running these tests with threads disabled in Atanks, so I'm
pretty sure whatever is going wrong is just in this one block of code.

Can anyone confirm this is where the issue is occuring for them? I'm
running the following.....

make
gdb ./atanks
> set args --nothread
> break atanks.cpp:1318
> r

Atanks opens. Go to the Options menu. When the program stops run this in
the debugger
> watch opts[0].name
> watch my_pointer
> continue

The debugger stops on my machine when it hits line 1321, indicating
opts[0].name has changed from "Physics" to a string of random data.


Thoughts?