Curing poison on NPC via item crashes Sphere

[mtwango]

When item is linked to NPC and casts cure on it via link.spelleffect s_cure 1000 sphere crashes.

Testing item:

[ITEMDEF i_test_tile]
ID=01826
NAME=Healing tile
TYPE=0

on=@dclick
  src.sysmessage Testing cure on character via item.
  if (!<link.isvalid> || <link.serial> >= 040000000)
    src.sysmessage invalid link.
    return 1
  endif

  link.flags = <link.flags>|statf_poisoned
  timer = 5
  return 1 

on=@timer
  if (!<link.isvalid> || <link.serial> >= 040000000)
    say invalid link.
    link = 04fffffff
    timer = -1
    return 1
  endif
  
  // Crash occurs here.
  link.spelleffect = s_cure 1000
  timer = 5
  return 1

Testing: Link item to npc and dclick.

Stacktrace in screen:

[drk84]

This happens because in @Timer src is the server object, i bet there are other function that will cause the same problem when ran inside a timer trigger

[mtwango]

This issue is related to checking IsPriv on null pointer. In the CChar::OnSpellEffect, case SPELL_Arch_Cure and SPELL_Cure, the pChar si sent to check priv, but its already null pointer in this case, so we are trying to call nullptr->IsPriv(). The fix would be to use pchar && pchar->IsPriv().
It would also need to be added in the messages to player (so we dont send messages to nullptr).

The only other place, the CServerConfig::Calc_CurePoisonChance is used is in CChar::Skill_Healing and since only characters can start skill, it should be save there.

ref:

Source-X/src/game/chars/CCharSpell.cpp

Line 3916 in 779caa0

case SPELL_Arch_Cure:

[51812180-gif]

I encountered this issue last year. When I ran it in debug mode, it showed a memory access violation (out-of-bounds error), but I mistakenly assumed it was intended behavior.……
ON=@GetHit
if (<i.FLAGS> & statf_poisoned)
i.SPELLEFFECT 25,1000,-1,0
return 1
endif

[mtwango]

Fixed on dev