Bug#749723: doomsday: Wrong order of arguments to cause undefined behaviour

[Michael Tautschnig]

Package: doomsday
Version: 1.10.4-2
Usertags: goto-cc

During a rebuild of all packages in a clean sid chroot (and cowbuilder+pbuilder)
the build failed with the following error. Please note that we use our research
compiler tool-chain (using tools from the cbmc package), which permits extended
reporting on type inconsistencies at link time.

[...]
gcc -c -m64 -pipe -std=c99 -fms-extensions -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2 -D_REENTRANT -Werror-implicit-function-declaration -fdiagnostics-show-option -fPIC -DNDEBUG -DHOST_IS_64BIT -DDENG_STABLE -DUNIX -DDENG_BASE_DIR="\"/usr/share/doomsday/\"" -DDENG_LIBRARY_DIR="\"/usr/lib/doomsday/plugins/\"" -DDENG_NO_FIXED_ASM -DDENG_NO_RANGECHECKING -DDENG_NO_QT -DDENG2_C_API_ONLY -D__JHEXEN__ -DQT_NO_DEBUG -I/usr/share/qt4/mkspecs/linux-g++-64 -I. -I/usr/include/qt4 -I../../api -I../../libdeng2/include -I../../libdeng1/include -I../common/include -I/portable/include -I../../external/lzss/portable/include -Iinclude -I. -o p_spec.o src/p_spec.c
file src/p_spec.c line 957 function P_LightningFlash: in expression `plrmo->origin[(signed long int)0] + (double)(16 * ((signed int)M_Random() - 127) << 16)':
conversion from `double' to `mobjtype_t': implicit conversion not permitted
CONVERSION ERROR
make[3]: *** [p_spec.o] Error 64
make[3]: Leaving directory `/srv/jenkins-slave/workspace/sid-goto-cc-doomsday/doomsday-1.10.4/doomsday/plugins/hexen'
make[2]: *** [sub-hexen-make_default] Error 2
make[2]: Leaving directory `/srv/jenkins-slave/workspace/sid-goto-cc-doomsday/doomsday-1.10.4/doomsday/plugins'
make[1]: *** [sub-plugins-make_default-ordered] Error 2

Reviewing the declaration of P_SpawnMobjXYZ

http://sources.debian.net/src/doomsday/1.10.4-2/doomsday/plugins/hexen/include/p_mobj.h?hl=211#L211

and also looking at other call sites it seems this is not necessarily an
intentional conversion of a double to an enum mobjtype_t on the first argument.
I believe the fourth argument should rather go in the first position upon the
call here:

http://sources.debian.net/src/doomsday/1.10.4-2/doomsday/plugins/hexen/src/p_spec.c?hl=957#L957

Best,
Michael

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 859 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/pkg-games-devel/attachments/20140529/eb18a6c8/attachment.sig>