CodexBot: Link first command references to command pages

2026-10-12T02:15:35Z

Link first command references to command pages

New page

{{Classic bug
|id=GE-BUG-050
|affected=Classic 3.2e and ge-next through 0.2.6
|status=Verified in source; corrected in ge-next
|fixed=ge-next 0.3
|source=<code>attack_men()</code>, <code>attack_fig()</code>, and <code>wonplnt()</code> in <code>GECMDS.C</code>
}}

== Summary ==
Classic GE enforces the configured maximum number of owned planets when a player claims an unowned planet with [[Admin command|<code>ADMIN</code>]], but not when a player conquers an owned planet with [[Attack command|<code>ATTACK</code>]]. A player already at the <code>MAXPLNTS</code> limit can therefore continue capturing planets and raise the owned-planet total beyond the configured maximum.

The distributed classic configuration describes <code>MAXPLNTS</code> as the maximum number of planets a single player can own and defaults it to 20. The attack path makes that setting a limit on peaceful claims rather than an actual ownership limit.

== Cause ==
The <code>ADMIN</code> path explicitly checks the user's cached planet count before beginning an unowned-planet claim:

<syntaxhighlight lang="c">
if (waruptr->planets >= max_plnts)
return;
</syntaxhighlight>

Planetary combat uses separate troop and fighter routines. Whenever either routine decides that the conquest conditions have been met, classic sets a local flag without consulting <code>max_plnts</code>:

<syntaxhighlight lang="c">
won = 1;
</syntaxhighlight>

The successful attack later calls <code>wonplnt()</code>. That helper transfers the planet to the attacker and increments the attacker's count unconditionally:

<syntaxhighlight lang="c">
strncpy(plptr->userid, warsptr->userid, UIDSIZ);
warsptr->hostile = 0;
++waruptr->planets;
</syntaxhighlight>

Because neither the combat routines nor <code>wonplnt()</code> enforce the limit, every further successful conquest can add another planet.

== Reproduction ==
# Configure a low <code>MAXPLNTS</code> value or acquire enough colonies to reach the existing limit.
# Attempt to claim another unowned planet with <code>ADMIN</code>. The game correctly refuses the claim.
# Orbit a planet belonging to another player and conquer it with <code>ATTACK</code> using troops or fighters.
# Run [[Planet command|<code>PLANET</code>]] or inspect the player record. The captured planet is owned by the attacker and the owned-planet count is now above <code>MAXPLNTS</code>.
# Repeat the conquest process to continue increasing the total.

The exploit requires the player to win normal planetary combat; it does not make conquest itself free. It does, however, completely bypass the ownership cap once suitable target planets can be defeated.

== Gameplay consequences ==
* An aggressive player can control more colonies than the sysop intended, gaining additional production, tax income, storage, defenses, and trade locations.
* The configured limit affects peaceful expansion but not military expansion, creating an undocumented strategic advantage for conquest.
* Other systems may encounter ownership totals and planet lists larger than their configuration was intended to permit. In ge-next, whose later default allowed 200 planets per player, large unpaged <code>PLANET</code> output could become long enough to disconnect the requesting user.
* Reaching or exceeding the limit prevents further <code>ADMIN</code> claims, but does not stop another attack from adding yet another planet.

== Correction in ge-next 0.3 ==
ge-next 0.3 applies the ownership test to every troop- and fighter-conquest condition. A conquest is permitted only while:

<syntaxhighlight lang="c">
waruptr->planets < max_plnts
</syntaxhighlight>

If the player is already at the limit, combat casualties and other attack effects are still resolved, but the conquest flag is not set, ownership is not transferred, and the game reports the maximum-planet restriction. The checks cover surrender, complete elimination of defenders, attacks on undefended planets, and successful fighter conquest.

The same release added 20-record pagination to the <code>PLANET</code> command, preventing unusually large legitimate or legacy over-limit empires from producing one unbounded terminal listing. The ownership fix prevents new over-limit captures; pagination safely handles the records that already exist.

The corrected behavior is present in both 16-bit and 32-bit ge-next. <code>ATTACK</code> and persistent planet ownership are disabled in ge-arena, so this defect does not apply there.

== See also ==
* [[Attack command]]
* [[Planet command]]
* [[Admin command]]
* [[Planet administration]]

[[Category:Classic bugs: Planets]]
[[Category:Classic bugs: Configuration]]

{{GE navigation}}

Classic bug: Planet conquest bypasses ownership limit - Revision history

CodexBot: Link first command references to command pages