[Freeciv-tickets] [freeciv] #46286: AI likely weakened by integer overflow

Back to archive index
OSDN Ticket System norep****@osdn*****
Sun Dec 25 09:38:50 JST 2022


#46286: AI likely weakened by integer overflow

  Open Date: 2022-12-16 01:09
Last Update: 2022-12-25 02:38

URL for this Ticket:
    https://osdn.net//projects/freeciv/ticket/46286
RSS feed for this Ticket:
    https://osdn.net/ticket/ticket_rss.php?group_id=12505&tid=46286

---------------------------------------------------------------------

Last Changes/Comment on this Ticket:
2022-12-25 02:38 Updated by: cazfi

Comment:

Reply To mortmann
not yet, because "unsigned int" is no final solution.

so you prefer to have "unsigned int" now and leave a ticket open for a real solution in the future? then i would prepare the PR/patch.

or should we instead work towards a real solution now?
We want to improve situation in stable branches (S3_1 and S3_0 at least, maybe even S2_6). Not sure if "real solution" is going to be acceptable to those, so likely we should go by the two steps approach of first having "unsigned int", and later more extensive one. That also means two tickets; for one can't have ticket listed in resolved tickets in 3.0.6 release notes if it in fact isn't resolved. You can either keep this as the "complete solution" ticket (-> split 'unsigned int' part to new ticket), or the "initial solution" ticket (-> open a new ticket about further changes) - both are fine for me.

---------------------------------------------------------------------
Ticket Status:

      Reporter: mortmann
         Owner: (None)
          Type: Bugs
        Status: Open
      Priority: 5 - Medium
     MileStone: 3.0.6
     Component: AI
      Severity: 5 - Medium
    Resolution: None
---------------------------------------------------------------------

Ticket details:

AI desire to kill likely weakened by integer overflow in ai/default/aiunit.c:kill_desire()
Depending on input values, instead of returning a big positive value for desire to kill, it returns a negative one.
Even if freeciv is compiled on 64 bit systems, the integer calculation is performed 32 bit.
Random example from a real game:
input values for kill_desire():
int benefit = 7824
int attack =  6400
int loss = 50
int vuln = 12544
int victim_count = 3
SHIELD_WEIGHTING = 17 by #define
Current formula:
desire = ((benefit * attack - loss * vuln) * victim_count * SHIELD_WEIGHTING / (attack + vuln * victim_count));
result: desire =  -40270
Ive got 2 ideas how so solve it:
1. Mitigate the overflow, cap the value of (benefit * attack - loss * vuln) * victim_count so that the overflow wont happen, like:
desire = (benefit * attack - loss * vuln) * victim_count;`

if (desire < (INT_MAX / SHIELD_WEIGHTING)) { /* mitigate signed integer overflow */
  desire *= SHIELD_WEIGHTING;
} else {
  desire = INT_MAX;
}
result: desire = 48770
Theoretically the overflow could still happen before multiplying with SHIELD_WEIGHTING, but it would be an improvement over the more easily triggered overflows happening right now. The cases ive seen in real game, would be mitigated.
2. Fix the overflow for systems, that have long to be 64 bit:
desire = (long) (benefit * attack - loss * vuln) * victim_count * SHIELD_WEIGHTING / (attack + vuln * victim_count);
result: desire = 57271
I quickly went over the source code, and i dont see any 64 bit stuff happening. Also i dont know how you handle portability and such in freeciv. Thats why i didnt propose the use of int64_t here. Can you find better solutions?

-- 
Ticket information of Freeciv project
Freeciv Project is hosted on OSDN

Project URL: https://osdn.net/projects/freeciv/
OSDN: https://osdn.net

URL for this Ticket:
    https://osdn.net/projects/freeciv/ticket/46286
RSS feed for this Ticket:
    https://osdn.net/ticket/ticket_rss.php?group_id=12505&tid=46286



More information about the Freeciv-tickets mailing list
Back to archive index