Один из лучших способов снизить количество багов в играх – это показывать программистам, как не стоит писать код. В своём докладе я соберу самые вкусные и необычные ошибки, которые удалось найти в C++ и C# коде таких игр, как VVVVVV, Space Engineers, Command & Conquer, osu! и даже Doom. Я уверен, что каждый из слушателей обязательно узнает для себя что-то новое. В конце концов, это просто приятно – лично увидеть ошибки из кода знакомой и любимой игры!

1. Самые вкусные баги из игрового кода:
как ошибаются
наши коллеги-программисты
Докладчик:
Георгий Грибков

2. Докладчик
Георгий Грибков
Программист C++, разработчик
статического анализатора кода
PVS-Studio
Автор статей и докладов о поиске
ошибок в играх (Вангеры, VVVVVV)
и других проектах
с открытым исходным кодом
gribkov@viva64.com
2

3. 1. Как мы ищем ошибки в коде
2. Примеры и разбор найденных ошибок
3. Мысли напоследок
Содержание
3

4. Как мы ищем ошибки в коде
4

5. Как мы ищем ошибки в коде
5
Обновляемый список статей
о проверке проектов:

6. Примеры и разбор найденных ошибок
6

7. System Shock (Си)
7

8. fix Terrain( fix X, fix Y, int deriv ) {
if( deriv == 0 )
return fix_mul( fix_make(0,0x2000), (X - fix_make(20,0) ) );
if( deriv == 1 )
return fix_mul( fix_make(0,0x2000), (X - fix_make(20,0) ) );
if( deriv == 2 )
return 0;
return 0;
}
Пример №1
8

9. fix Terrain( fix X, fix Y, int deriv ) {
if( deriv == 0 )
return fix_mul( fix_make(0,0x2000), (X - fix_make(20,0) ) );
if( deriv == 1 )
return fix_mul( fix_make(0,0x2000), (X - fix_make(20,0) ) );
if( deriv == 2 )
return 0;
return 0;
}
Пример №1
9
V751 Parameter 'Y' is not used
inside function body. BTEST.C 67

10. fix Terrain( fix X, fix Y, int deriv ) {
if( deriv == 0 )
return fix_mul( fix_make(0,0x2000), (X - fix_make(20,0) ) );
if( deriv == 1 )
return fix_mul( fix_make(0,0x2000), (Y - fix_make(20,0) ) );
if( deriv == 2 )
return 0;
return 0;
}
Пример №1
10
V751 Parameter 'Y' is not used
inside function body. BTEST.C 67

11. // And here, ladies and gentlemen,
// is a celebration of C and C++ and their untamed
passion...
// ==================
TerrainData terrain_info;
// Now the actual stuff...
// =======================
Забавные комментарии
11

12. // it's a wonderful world, with a lot of strange men
// who are standing around, and they all wearing towels
// Returns whether or not in the humble opinion of the
// sound system, the sample should be politely
// obliterated out of existence
Забавные комментарии
12

13. Space
Engineers (C#)
13

14. if (....)
MySandboxGame.Log.WriteLine(string.Format(
"Could not find any sound for '{0}'", cueName));
else
{
if (....)
string.Format(
"Could not find arcade sound for '{0}'", cueName);
if (....)
string.Format(
"Could not find realistic sound for '{0}'", cueName);
}
Пример №1
14

15. if (....)
MySandboxGame.Log.WriteLine(string.Format(
"Could not find any sound for '{0}'", cueName));
else
{
if (....)
string.Format(
"Could not find arcade sound for '{0}'", cueName);
if (....)
string.Format(
"Could not find realistic sound for '{0}'", cueName);
}
Пример №1
15
V3010 The return value of function 'Format' is required to
be utilized. Sandbox.Game MyEntity3DSoundEmitter.cs

16. if (....)
MySandboxGame.Log.WriteLine(string.Format(
"Could not find any sound for '{0}'", cueName));
else
{
if (....)
MySandboxGame.Log.WriteLine(string.Format(
"Could not find arcade sound for '{0}'", cueName));
if (....)
MySandboxGame.Log.WriteLine(string.Format(
"Could not find realistic sound for '{0}'", cueName));
}
Пример №1
16
V3010 The return value of function 'Format' is required to
be utilized. Sandbox.Game MyEntity3DSoundEmitter.cs

17. var actionsItem = item as MyToolbarItemActions;
if (item != null)
{
if (idx < 0 || idx >= actionsItem
.PossibleActions(....)
.Count)
RemoveToolbarItem(slot);
....
}
Пример №2
17

18. var actionsItem = item as MyToolbarItemActions;
if (item != null)
{
if (idx < 0 || idx >= actionsItem
.PossibleActions(....)
.Count)
RemoveToolbarItem(slot);
....
}
Пример №2
18
V3019 Possibly an incorrect variable is compared to null after type
conversion using 'as' keyword. Check variables 'item', 'actionsItem'.
Sandbox.Game MyGuiControlToolbar.cs 511

19. var actionsItem = item as MyToolbarItemActions;
if (item != null)
{
if (idx < 0 || idx >= actionsItem
.PossibleActions(....)
.Count)
RemoveToolbarItem(slot);
....
}
Пример №2
19
V3019 Possibly an incorrect variable is compared to null after type
conversion using 'as' keyword. Check variables 'item', 'actionsItem'.
Sandbox.Game MyGuiControlToolbar.cs 511

20. var actionsItem = item as MyToolbarItemActions;
if (actionsItem != null)
{
if (idx < 0 || idx >= actionsItem
.PossibleActions(....)
.Count)
RemoveToolbarItem(slot);
....
}
Пример №2
20
V3019 Possibly an incorrect variable is compared to null after type
conversion using 'as' keyword. Check variables 'item', 'actionsItem'.
Sandbox.Game MyGuiControlToolbar.cs 511

21. C&C: Tiberian Dawn и C&C: Red Alert (C++)
21

22. // Maximum number of multi players possible.
#define MAX_PLAYERS 8 // max # of players we can have
for (int i = 0; i < MAX_PLAYERS && i < 4; i++) {
if (GlyphxPlayerIDs[i] == player_id) {
MultiplayerStartPositions[i] = XY_Cell(x, y);
}
}
Пример №1
22

23. // Maximum number of multi players possible.
#define MAX_PLAYERS 8 // max # of players we can have
for (int i = 0; i < MAX_PLAYERS && i < 4; i++) {
if (GlyphxPlayerIDs[i] == player_id) {
MultiplayerStartPositions[i] = XY_Cell(x, y);
}
}
Пример №1
23
V590 Consider inspecting the 'i < 8 && i < 4' expression.
The expression is excessive or contains a misprint.
DLLInterface.cpp 2238

24. // Maximum number of multi players possible.
#define MAX_PLAYERS 8 // max # of players we can have
for (int i = 0; i < MAX_PLAYERS || i < 4; i++) {
if (GlyphxPlayerIDs[i] == player_id) {
MultiplayerStartPositions[i] = XY_Cell(x, y);
}
}
Пример №1
24
V590 Consider inspecting the 'i < 8 && i < 4' expression.
The expression is excessive or contains a misprint.
DLLInterface.cpp 2238

25. void * ptr = new char [sizeof(100)];
if (ptr) {
sprintf((char *)ptr,
"%cTrack %dt%d:%02dt%s",
....);
listbox.Add_Item((char const *)ptr);
}
Пример №2
25

26. void * ptr = new char [sizeof(100)];
if (ptr) {
sprintf((char *)ptr,
"%cTrack %dt%d:%02dt%s",
....);
listbox.Add_Item((char const *)ptr);
}
Пример №2
26
V512 A call of the 'sprintf' function will lead to overflow of
the buffer '(char *) ptr'. SOUNDDLG.CPP 250

27. void * ptr = new char [100];
if (ptr) {
sprintf((char *)ptr,
"%cTrack %dt%d:%02dt%s",
....);
listbox.Add_Item((char const *)ptr);
}
Пример №2
27
V512 A call of the 'sprintf' function will lead to overflow of
the buffer '(char *) ptr'. SOUNDDLG.CPP 250

28. 28

29. Doom 3 (C++)
29

30. for ( j = 0; j < w.GetNumPoints(); j++ ) {
for ( k = 0; k < verts.Num(); j++ ) {
if ( verts[k].xyz.Compare(w[j].ToVec3(),
POLYTOPE_VERTEX_EPSILON))
{
break;
}
}
...
}
Пример №1
30

31. for ( j = 0; j < w.GetNumPoints(); j++ ) {
for ( k = 0; k < verts.Num(); j++ ) {
if ( verts[k].xyz.Compare(w[j].ToVec3(),
POLYTOPE_VERTEX_EPSILON))
{
break;
}
}
...
}
Пример №1
31
V533 It is likely that a wrong variable is being
incremented inside the 'for' operator. Consider
reviewing 'j'. idLib surface_polytope.cpp 65

32. for ( j = 0; j < w.GetNumPoints(); j++ ) {
for ( k = 0; k < verts.Num(); k++ ) {
if ( verts[k].xyz.Compare(w[j].ToVec3(),
POLYTOPE_VERTEX_EPSILON))
{
break;
}
}
...
}
Пример №1
32
V533 It is likely that a wrong variable is being
incremented inside the 'for' operator. Consider
reviewing 'j'. idLib surface_polytope.cpp 65

33. void idBrushBSP::FloodThroughPortals_r
(idBrushBSPNode *node, ...)
{
...
if ( node->occupied ) {
common->Error( "Node already occupiedn" );
}
if ( !node ) {
common->Error( "NULL noden" );
}
...
}
Пример №2
33

34. void idBrushBSP::FloodThroughPortals_r
(idBrushBSPNode *node, ...)
{
...
if ( node->occupied ) {
common->Error( "Node already occupiedn" );
}
if ( !node ) {
common->Error( "NULL noden" );
}
...
}
Пример №2
34
V595 The 'node' pointer was utilized before it was
verified against nullptr. Check lines: 1421, 1424.
DoomDLL brushbsp.cpp 1421

35. Пример №2
35

36. void idBrushBSP::FloodThroughPortals_r
(idBrushBSPNode *node, ...)
{
...
if ( node->occupied ) {
common->Error( "Node already occupiedn" );
}
if ( !node ) {
common->Error( "NULL noden" );
}
...
}
Пример №2
36
V595 The 'node' pointer was utilized before it was
verified against nullptr. Check lines: 1421, 1424.
DoomDLL brushbsp.cpp 1421

37. void idBrushBSP::FloodThroughPortals_r
(idBrushBSPNode *node, ...)
{
...
if ( !node ) {
common->Error( "NULL noden" );
}
if ( node->occupied ) {
common->Error( "Node already occupiedn" );
}
...
}
Пример №2
37
V595 The 'node' pointer was utilized before it was
verified against nullptr. Check lines: 1421, 1424.
DoomDLL brushbsp.cpp 1421

38. osu! (C#)
38

39. public RulesetInfo GetRuleset(int id) =>
AvailableRulesets.FirstOrDefault(....);
....
public ScoreInfo CreateScoreInfo(RulesetStore rulesets) {
var ruleset = rulesets.GetRuleset(OnlineRulesetID);
var mods =
Mods != null
? ruleset.CreateInstance().GetAllMods().Where(....).ToArray()
: Array.Empty<Mod>();
....
}
Пример №1
39

40. public RulesetInfo GetRuleset(int id) =>
AvailableRulesets.FirstOrDefault(....);
....
public ScoreInfo CreateScoreInfo(RulesetStore rulesets) {
var ruleset = rulesets.GetRuleset(OnlineRulesetID);
var mods =
Mods != null
? ruleset.CreateInstance().GetAllMods().Where(....).ToArray()
: Array.Empty<Mod>();
....
}
Пример №1
40
V3146 Possible null dereference of 'ruleset'. The 'FirstOrDefault'
can return default null value. APILegacyScoreInfo.cs 24

41. public RulesetInfo GetRuleset(int id) =>
AvailableRulesets.FirstOrDefault(....);
....
public ScoreInfo CreateScoreInfo(RulesetStore rulesets) {
var ruleset = rulesets.GetRuleset(OnlineRulesetID);
var mods =
(Mods != null && ruleset != null)
? ruleset.CreateInstance().GetAllMods().Where(....).ToArray()
: Array.Empty<Mod>();
....
}
Пример №1
41
V3146 Possible null dereference of 'ruleset'. The 'FirstOrDefault'
can return default null value. APILegacyScoreInfo.cs 24

42. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT *
((IOsuScreen)next)?.BackgroundParallaxAmount ?? 1.0f;
}
Пример №2
42

43. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT *
((IOsuScreen)next)?.BackgroundParallaxAmount ?? 1.0f;
}
Пример №2
43
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45

44. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT *
((IOsuScreen)next)?.BackgroundParallaxAmount ?? 1.0f;
}
Пример №2
44
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45

45. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT *
((IOsuScreen)next)?.BackgroundParallaxAmount ?? 1.0f;
}
Пример №2
45
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45

46. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT *
((IOsuScreen)next)?.BackgroundParallaxAmount ?? 1.0f;
}
Пример №2
46
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45
x = (c * a) ?? b;

47. Пример №2
47
Что, если
((IOsuScreen)next)
окажется null?

48. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT *
((IOsuScreen)next)?.BackgroundParallaxAmount ?? 1.0f;
}
Пример №2
48
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45
x = (c * a) ?? b;

49. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT *
(null)?.BackgroundParallaxAmount ?? 1.0f;
}
Пример №2
49
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45
x = (c * a) ?? b;

50. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT *
null ?? 1.0f;
}
Пример №2
50
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45
x = (c * null) ?? b;

51. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
null
?? 1.0f;
}
Пример №2
51
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45
x = null ?? b;

52. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount = 1.0f;
}
Пример №2
52
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45
x = b;

53. Пример №2
53
Это ошибка!!!

54. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT *
((IOsuScreen)next)?.BackgroundParallaxAmount ?? 1.0f;
}
Пример №2
54
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45

55. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT *
(((IOsuScreen)next)?.BackgroundParallaxAmount ?? 1.0f);
}
Пример №2
55
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45
x = c * (a ?? b);

56. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT *
(null?.BackgroundParallaxAmount ?? 1.0f);
}
Пример №2
56
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45
x = c * (a ?? b);

57. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT *
(null ?? 1.0f);
}
Пример №2
57
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45
x = c * (null ?? b);

58. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT * 1.0f;
}
Пример №2
58
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45
x = c * b;

59. private void onScreenChange(IScreen prev, IScreen next)
{
parallaxContainer.ParallaxAmount =
ParallaxContainer.DEFAULT_PARALLAX_AMOUNT;
}
Пример №2
59
V3123 Perhaps the '??' operator works in a different way than it
was expected. Its priority is lower than priority of other operators
in its left part. OsuScreenStack.cs 45
x = c * b;

60. VVVVVV (C++)
60

61. TiXmlElement *pElem;
....
pElem = hDoc.FirstChildElement().Element();
if (!pElem)
{
printf("No valid root! Corrupt level file?n");
}
pElem->QueryIntAttribute("version", &version);
Пример №1
61

62. TiXmlElement *pElem;
....
pElem = hDoc.FirstChildElement().Element();
if (!pElem)
{
printf("No valid root! Corrupt level file?n");
}
pElem->QueryIntAttribute("version", &version);
Пример №1
62
V1004 The 'pElem' pointer was used unsafely after it was
verified against nullptr. Check lines: 1739, 1744. editor.cpp 1744

63. TiXmlElement *pElem;
....
pElem = hDoc.FirstChildElement().Element();
if (!pElem)
{
printf("No valid root! Corrupt level file?n");
return;
}
pElem->QueryIntAttribute("version", &version);
Пример №1
63
V1004 The 'pElem' pointer was used unsafely after it was
verified against nullptr. Check lines: 1739, 1744. editor.cpp 1744

64. TiXmlElement *pElem;
....
pElem = hDoc.FirstChildElement().Element();
if (!pElem)
{
printf("No valid root! Corrupt level file?n");
return; // Также можно было сделать throw
}
pElem->QueryIntAttribute("version", &version);
Пример №1
64
V1004 The 'pElem' pointer was used unsafely after it was
verified against nullptr. Check lines: 1739, 1744. editor.cpp 1744

65. Адский switch
65
 V2008 Cyclomatic complexity: 548. Consider
refactoring the 'Game::updatestate' function.
Game.cpp 612

66. Адский switch
66

67. Адский switch
67

68. Адский switch
68

69. Адский switch
69

70. Адский switch
70

71. Адский switch
71

72. Адский switch
72

73. Адский switch
73
 3339 строк
 Около 300 case-ветвей
 Ни одной enum-константы

74. Мысли напоследок
74

75.  Всех ошибок можно было избежать,
используя статический анализ кода
 Показанные примеры – лишь вершина
айсберга
Мысли напоследок
75

76. id Software
Wargaming
Epic Games
Playrix
Warner Brothers
Кто уже использует статический анализ
76
Oculus
Codemasters
Rocksteady
ZeniMax Media
И другие…

77. 77
Бесплатная лицензия
для open-source проектов:
Промокод на месяц:
www.viva64.com/pvs-free-
opensource
www.viva64.com/download-
devgamm