Savegame made with EasyRPG missing some SavePicture information (?) will crash RPG_RT.exe

[florianessl]

Name of the game:

Sternenkind-Saga 1.1.3

Player platform:

Windows

Attach files (as a .zip archive or link them)

https://drive.google.com/file/d/19ZJUs0L8S93AMUn34ebE7XsX-0V1ON0d

Describe the issue in detail and how to reproduce it:

I went through some more of my save files and found another one that crashes RPG_RT.exe. (Save01.esd). I have no idea what causes this. The error message by RPG_RT is indecipherable:

I loaded it up on EasyRPG Player, saved again and got another, very similar but working file that loads up fine on RPG_RT. (Save02.esd)
On comparing the two files with lcf2xml I noticed the second one contains much more <SavePicture> information that is missing from the faulty one. After manually coping those lines (<SavePicture id="0097"> to <SavePicture id="1000">) into the first save file, it is fixed and will successfully load on RPG_RT.
I have no way of reproducing this issue. This somehow happened on accident. One thing to note is, this savegame also contains the activated battleanim_target glitch (Loading it up on the Player, the first save file will play an animation that isn't supposed to be there) but won't crash RPG_RT.exe with an invalid Event ID, because this map contains an Event 0148.

[CherryDT]

48F1FF is the line if (this->image) in RPG::Picture::draw (I used DynRPG names here). It crashes because this is a null pointer. The error means that essentially this happened:

RPG::Picture * picture = nullptr; // coming from RPG::pictures[97] in this case
picture->draw();

So yes, missing picture entries in the save file could totally cause this (at least in versions prior to 1.50, see below), since the drawing loop just iterates over all pictures from 1 to the hardcoded maximum and doesn't care a lot about whether they exist - they are supposed to exist. Now, when loading the data from the save file, originally the array of pictures was cleared and then each entry created when the corresponding chunk was loaded, and that's why it crashes here because indices containing null pointers exist. In 1.50, this was changed so that after clearing the array, the array is first filled with empty picture instances before loading the chunks (any loaded chunk would then replace the empty picture with the loaded one). Presumably this was added because 1.50 increased the amount of pictures from 20 to 50, so without this change it would also crash when loading a pre-1.50 save file.