Root cause of three identical field crashes (audio thread, opcode fetch
through a pointer with its low 32 bits overwritten, seconds after scene
transitions): AudioHeap_AllocPermanent writes permanentCache[index] with
index = permanentPool.count and no bound against the 32-entry array. In
SoH every soundfont sync-load is forced permanent, and custom sequences
whose SEQ.xml says CachePolicy="Temporary" ALSO allocate permanently
(the factory stores the LUS enum where CACHE_TEMPORARY == 0, while
AudioLoad_SyncLoad's switch reads 0 with the ROM convention
'permanent'). A pack with ~60 streamed customs plus vanilla fonts pushes
count past 32 within a session, after which each allocation sprays a
{ptr, size, tableType/id} triplet at 24-byte stride through
gAudioContext - entry[135]'s ptr field lands exactly on
seqPlayers[0].scriptState.pc and entry[156] on seqPlayers[1]'s (both
verified against the crash-dump registers).
- permanentCache raised 32 -> 512 (12 KB) and AllocPermanent refuses
allocations past the array instead of corrupting memory.
- Same unbounded-index disease fixed in the three sibling writers:
AllocCached's persistent path (16-entry array; CACHE_EITHER degrades
to temporary, hard persistent requests fail cleanly),
AllocPersistentSampleCacheEntry, AllocTemporarySampleCacheEntry.
- seqLoadStatus malloc sized for the full id space (sequenceMapSize +
0xF) matching sequenceMap; custom ids above sequenceMapSize previously
overflowed the allocation by up to 15 bytes.
Upstream SoH bugs, not branch-introduced - this branch's many-track
packs merely made the overflow reachable in normal play. Standalone
upstreamable fix.
gItemSlots and sExtraItemBases only cover the item IDs that live in the
inventory, but Item_Give and Item_CheckObtainability index them with any
item ID. Reading past gItemSlots lands on gUpgradeShifts, so
INV_CONTENT(ITEM_SKULL_TOKEN) resolved to the Bow slot and stored the
token there, permanently corrupting the save.
Route both through a bounds-checked Item_GetSlot that reports SLOT_NONE
for items that have no slot, and skip the inventory store in that case.
That read is also undefined behaviour, which link-time optimization is
free to exploit: with it present clang dropped the ITEM_SKULL_TOKEN
branch and the ITEM_MEDALLION_WATER horse fixup from Item_Give
entirely, so tokens were never counted either.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Custom SAF sequence IDs can exceed sequenceMapSize, causing out-of-bounds
reads/writes on the seqLoadStatus byte array (sized exactly sequenceMapSize).
This is the direct cause of intermittent battle music failure with BGM packs
(issue #5706): on the second encounter, AudioLoad_SyncLoadSeq reads a garbage
value from heap memory past seqLoadStatus[] and may find 1 (loading in
progress), causing it to return NULL early — the sequence player is never
initialized and no battle music plays.
Symmetric fix to the fontLoadStatus guards in PR #6916:
- AudioLoad_IsSeqLoadComplete: return true for OOB seqIds (custom SAF
sequences are resource-manager-backed, not in the async-load status table)
- AudioLoad_SetSeqLoadStatus: skip update for seqId >= sequenceMapSize
- AudioLoad_SyncLoadSeq: skip the in-progress check for OOB seqIds
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Rewrite Gfx_TexScrollEx / Gfx_TwoTexScrollEx / Gfx_TwoTexScrollEnvColorEx to
emit one command per tile instead of one baked tile size per interpolated frame,
so texture DL memory no longer scales with InterpolationFPS
Allow player to try opening doors while climbing. Player can't open anything if a door doesn't offer it, so it's ok to try. Handle doors don't change player y position (player walks in the air), so manually lower it.
Increase y height limit for doors to offer open from 15.0f/20.0f to 50.0f (normal door height). (For shutter doors height could be individualized depending on shutter door type in the future.)
Make climbing up animation play even for sloped ledges. The animation/action breaks because game thinks player is not on ground. So, at the end of Player_ProcessSceneCollision, if player is in climbing up action, manually set BGCHECKFLAG_GROUND.
Adds an option for a Better Save Menu that, after saving, allows you to effectively soft-reset the current save (either return to spawn or reset to the dungeon entrance), and additionally lets you reset to spawn specifcally, even if you are in a dungeon. This allows for escaping from the rare entrance-rando related softlock that can happen.
If Ruto enters Bigocto's room after she has already been abducted, the room behaves weird due to actor functions. Randomizer respawns Ruto after abduction, so this can become a problem.
The easiest solution is probably to just not let player open doors to Bigocto room while carrying Ruto after abduction.
This fix makes shutter doors in randomizer when offering player to open the door - check scene, abduction flag, if door is transition actor index 21 or 3, held actor, and if held actor is Ruto.
Looks like this: https://www.youtube.com/watch?v=2Siq2Z41Pqo
The shutter door in decomp and thus this fix uses macros that are missing here, I copied all of them to the corresponding place in actor.h as they are very useful for actor params and will be added anyway when/if code is synced with decomp.
AudioLoad_IsFontLoadComplete had a stub `return true` that bypassed all
load-status checks, masking an out-of-bounds write: for large SAF packs
(many custom sequences) SetFontLoadStatus indexed fontLoadStatus[] with
fontId values larger than the fontMapSize-sized array, causing heap
corruption and semi-random crashes.
Remove the stub. Add a (size_t)fontId >= fontMapSize guard in both the
check and the setter: out-of-range IDs (custom SAF sequences that carry
no associated soundfont) are treated as "loaded" in the check and
silently skipped in the write, matching prior observable behavior while
eliminating the OOB access.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
All edge cases for bottle combinations and replacement/filling mirrors the real game, as well we produce the compass text, and does not render the item exactly as the original game does. (I would have preferred rendering the item since its only cosmetic but I couldn't find a way to do it).
This also swaps the table redirect stuff for using the direct item id's which is a lot more clear and does not substitute anything for 'good enough' and covers all the edge case ids that have been documented.
This is purely a cosmetic change to present the visual of the item without affecting the cutscene making any tricks for GIM still work and just looks more polished.
This supplies effects of ALL game versions (including MZX build) as well as providing text table.
To note: we still can crash with GIM even when returning item None EVEN at least with returning Kokiri Tunic (I can't really figure out why) and there are a few items in the table that use extra data that I don't know how to implement here just yet but the info is in the docs under "Variable".
In the case of disabling the gim restoration, the game would still crash. This change adds a text id protection to prevent crashing, as well prevents invalid items from crashing directly, and also makes it so the game will no longer crash when having GIM disabled in the menu.
Co-authored-by: serprex <159546+serprex@users.noreply.github.com>
djevangelia