Zone crash with FillAAEffects()

[trevius]

Been seeing this crash occasionally on a few characters lately. The crash happens as soon as the "bugged" client tries to log in, every time. To resolve, I have been manually clearing out the AA that the crash reports is the cause directly in the character blob. I am not seeing the cause of this crash yet, but it only started a couple of weeks ago, so may be due to a recent change or maybe some DB issue with AAs. Not sure if any other server has seen this issue as well.

Core was generated by `./zone dynamic_21 zone'.
Program terminated with signal 6, Aborted.
[New process 27279]
[New process 27283]
[New process 27282]
[New process 27281]
[New process 27280]
#0 0xb774f424 in __kernel_vsyscall ()
(gdb) bt
#0 0xb774f424 in __kernel_vsyscall ()
#1 0xb71a6640 in raise () from /lib/i686/cmov/libc.so.6
#2 0xb71a8018 in abort () from /lib/i686/cmov/libc.so.6
#3 0xb71e348d in __libc_message () from /lib/i686/cmov/libc.so.6
#4 0xb71e9764 in malloc_printerr () from /lib/i686/cmov/libc.so.6
#5 0xb71eb6b3 in _int_free () from /lib/i686/cmov/libc.so.6
#6 0xb71eb966 in free () from /lib/i686/cmov/libc.so.6
#7 0xb74ac0a1 in my_no_flags_free () from /usr/lib/libmysqlclient.so.15
#8 0xb74d2c58 in mysql_free_result () from /usr/lib/libmysqlclient.so.15
#9 0x081fc347 in ZoneDatabase::FillAAEffects (this=0x8a04940, aa_struct=0x9294a20) at AA.cpp:1534
#10 0x081ff7c2 in Client::SendAA (this=0x92a79e0, id=0, seq=211) at AA.cpp:1154
#11 0x081ff832 in Client::SendAAList (this=0x92a79e0) at AA.cpp:1186
#12 0x08215ebf in Client::Handle_Connect_OP_SendAATable (this=0x92a79e0, app=0xae3ada20) at client_packet.cpp:597
#13 0x08216575 in Client::HandlePacket (this=0x92a79e0, app=0xae3ada20) at client_packet.cpp:425
#14 0x08129d91 in Client::Process (this=0x92a79e0) at client_process.cpp:724
#15 0x080f720a in EntityList::MobProcess (this=0x849b6e0) at entity.cpp:487
#16 0x08134a27 in main (argc=Cannot access memory at address 0x6a8f
) at net.cpp:493
(gdb) frame 9
#9 0x081fc347 in ZoneDatabase::FillAAEffects (this=0x8a04940, aa_struct=0x9294a20) at AA.cpp:1534
1534 mysql_free_result(result);
(gdb) frame 10
#10 0x081ff7c2 in Client::SendAA (this=0x92a79e0, id=0, seq=211) at AA.cpp:1154
1154 database.FillAAEffects(saa);
(gdb) print this->name
$1 = "Melchior", '\0' <repeats 55 times>
(gdb) print this->class_
$2 = 13 '\r'
(gdb) list
1149 saa->cost2 = 0;
1150 for(int i=0;i<value;i++){
1151 saa->cost2 += saa2->cost + (saa2->cost_inc * i);
1152 }
1153 }
1154 database.FillAAEffects(saa);
1155
1156 if(value > 0)
1157 {
1158 const AA_DBAction *caa = &AA_Actions[saa->id][value - 1];
(gdb) print saa
$3 = (SendAA_Struct *) 0x9294a20
(gdb) print saa->id
$4 = 674
(gdb) frame 9
#9 0x081fc347 in ZoneDatabase::FillAAEffects (this=0x8a04940, aa_struct=0x9294a20) at AA.cpp:1534
1534 mysql_free_result(result);
(gdb) list
1529 aa_struct->abilities[ndx].base1=atoi(row[1]);
1530 aa_struct->abilities[ndx].base2=atoi(row[2]);
1531 aa_struct->abilities[ndx].slot=atoi(row[3]);
1532 ndx++;
1533 }
1534 mysql_free_result(result);
1535 } else {
1536 LogFile->write(EQEMuLog::Error, "Error in Client::FillAAEffects query: '%s': %s", query, errbuf);
1537 }
1538 safe_delete_array(query);
(gdb) frame 8
#8 0xb74d2c58 in mysql_free_result () from /usr/lib/libmysqlclient.so.15
(gdb) list
1539 }
1540
1541 int32 ZoneDatabase::CountAAs(){
1542 char errbuf[MYSQL_ERRMSG_SIZE];
1543 char *query = 0;
1544 MYSQL_RES *result;
1545 MYSQL_ROW row;
1546 int count=0;
1547 if (RunQuery(query, MakeAnyLenString(&query, "SELECT count(title_sid) from altadv_vars"), errbuf, &result)) {
1548 if((row = mysql_fetch_row(result))!=NULL)
(gdb)

AA.cpp

void ZoneDatabase::FillAAEffects(SendAA_Struct* aa_struct){
        if(!aa_struct)
                return;

        char errbuf[MYSQL_ERRMSG_SIZE];
    char *query = 0;
    MYSQL_RES *result;
    MYSQL_ROW row;
        if (RunQuery(query, MakeAnyLenString(&query, "SELECT effectid, base1, base2, slot from aa_effects where aaid=%i order by slot asc", aa_struct->id), errbuf, &result)) {
                int ndx=0;
                while((row = mysql_fetch_row(result))!=NULL) {
                        aa_struct->abilities[ndx].skill_id=atoi(row[0]);
                        aa_struct->abilities[ndx].base1=atoi(row[1]);
                        aa_struct->abilities[ndx].base2=atoi(row[2]);
                        aa_struct->abilities[ndx].slot=atoi(row[3]);
                        ndx++;
                }
                mysql_free_result(result);
        } else {
                LogFile->write(EQEMuLog::Error, "Error in Client::FillAAEffects query: '%s': %s", query, errbuf);                       
        }
        safe_delete_array(query);
}