Classic bug: Planet conquest bypasses ownership limit

Bug ID	GE-BUG-050
Affected versions	Classic 3.2e and ge-next through 0.2.6
Status	Verified in source; corrected in ge-next
Fixed in	ge-next 0.3
Primary source	`attack_men()`, `attack_fig()`, and `wonplnt()` in `GECMDS.C`

Summary

Classic GE enforces the configured maximum number of owned planets when a player claims an unowned planet with ADMIN, but not when a player conquers an owned planet with ATTACK. A player already at the MAXPLNTS limit can therefore continue capturing planets and raise the owned-planet total beyond the configured maximum.

The distributed classic configuration describes MAXPLNTS as the maximum number of planets a single player can own and defaults it to 20. The attack path makes that setting a limit on peaceful claims rather than an actual ownership limit.

Cause

The ADMIN path explicitly checks the user's cached planet count before beginning an unowned-planet claim:

if (waruptr->planets >= max_plnts)
    return;

Planetary combat uses separate troop and fighter routines. Whenever either routine decides that the conquest conditions have been met, classic sets a local flag without consulting max_plnts:

won = 1;

The successful attack later calls wonplnt(). That helper transfers the planet to the attacker and increments the attacker's count unconditionally:

strncpy(plptr->userid, warsptr->userid, UIDSIZ);
warsptr->hostile = 0;
++waruptr->planets;

Because neither the combat routines nor wonplnt() enforce the limit, every further successful conquest can add another planet.

Reproduction

Configure a low MAXPLNTS value or acquire enough colonies to reach the existing limit.
Attempt to claim another unowned planet with ADMIN. The game correctly refuses the claim.
Orbit a planet belonging to another player and conquer it with ATTACK using troops or fighters.
Run PLANET or inspect the player record. The captured planet is owned by the attacker and the owned-planet count is now above MAXPLNTS.
Repeat the conquest process to continue increasing the total.

The exploit requires the player to win normal planetary combat; it does not make conquest itself free. It does, however, completely bypass the ownership cap once suitable target planets can be defeated.

Gameplay consequences

An aggressive player can control more colonies than the sysop intended, gaining additional production, tax income, storage, defenses, and trade locations.
The configured limit affects peaceful expansion but not military expansion, creating an undocumented strategic advantage for conquest.
Other systems may encounter ownership totals and planet lists larger than their configuration was intended to permit. In ge-next, whose later default allowed 200 planets per player, large unpaged PLANET output could become long enough to disconnect the requesting user.
Reaching or exceeding the limit prevents further ADMIN claims, but does not stop another attack from adding yet another planet.

Correction in ge-next 0.3

ge-next 0.3 applies the ownership test to every troop- and fighter-conquest condition. A conquest is permitted only while:

waruptr->planets < max_plnts

If the player is already at the limit, combat casualties and other attack effects are still resolved, but the conquest flag is not set, ownership is not transferred, and the game reports the maximum-planet restriction. The checks cover surrender, complete elimination of defenders, attacks on undefended planets, and successful fighter conquest.

The same release added 20-record pagination to the PLANET command, preventing unusually large legitimate or legacy over-limit empires from producing one unbounded terminal listing. The ownership fix prevents new over-limit captures; pagination safely handles the records that already exist.

The corrected behavior is present in both 16-bit and 32-bit ge-next. ATTACK and persistent planet ownership are disabled in ge-arena, so this defect does not apply there.