Prevent item insert crash

[dseguin]

Summary

None

Purpose of change

• Fixes Fluids directly insertable into meta-container when not full #56856

When inserting an item into a container, the game checks for available nested pockets within the container as well. The issue is that it doesn't check that the nested pocket already contains that item. (This causes a crash in insert_item_activity_actor::finish for any count-by-charge item, not just liquids)

(ASAN stack trace):

==61526==ERROR: AddressSanitizer: heap-use-after-free on address 0x61600137ca98 at pc 0x55555b225344 bp 0x7fffffffb590 sp 0x7fffffffb580
READ of size 8 at 0x61600137ca98 thread T0
    #0 0x55555b225343 in item::item(item const&) src/item.h:181
    #1 0x555558ef2e6e in insert_item_activity_actor::finish(player_activity&, Character&) src/activity_actor.cpp:3949
    #2 0x55555d7e3bff in player_activity::do_turn(Character&) src/player_activity.cpp:363
    #3 0x55555a5c797c in do_turn() src/do_turn.cpp:660
    #4 0x55555bd7fa35 in main src/main.cpp:766
    #5 0x7ffff6e7d0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)
    #6 0x555558d598cd in _start (/home/dtsadmin/Builds/Cataclysm-DDA/cataclysm-tiles+0x38058cd)

0x61600137ca98 is located 24 bytes inside of 608-byte region [0x61600137ca80,0x61600137cce0)
freed by thread T0 here:
    #0 0x7ffff768e51f in operator delete(void*) ../../../../src/libsanitizer/asan/asan_new_delete.cc:165
    #1 0x555558fc67eb in __gnu_cxx::new_allocator<std::_List_node<item> >::deallocate(std::_List_node<item>*, unsigned long) /usr/include/c++/9/ext/new_allocator.h:128
    #2 0x555558faddcf in std::allocator_traits<std::allocator<std::_List_node<item> > >::deallocate(std::allocator<std::_List_node<item> >&, std::_List_node<item>*, unsigned long) /usr/include/c++/9/bits/alloc_traits.h:469
    #3 0x555558f937dd in std::__cxx11::_List_base<item, std::allocator<item> >::_M_put_node(std::_List_node<item>*) /usr/include/c++/9/bits/stl_list.h:442
    #4 0x5555591770dc in std::__cxx11::list<item, std::allocator<item> >::_M_erase(std::_List_iterator<item>) /usr/include/c++/9/bits/stl_list.h:1926
    #5 0x55555916af4a in std::__cxx11::list<item, std::allocator<item> >::erase(std::_List_const_iterator<item>) /usr/include/c++/9/bits/list.tcc:158
    #6 0x55555b77c095 in item_pocket::restack() src/item_pocket.cpp:273
    #7 0x55555b79c0a4 in item_pocket::insert_item(item const&) src/item_pocket.cpp:1819
    #8 0x55555b319834 in item::fill_with(item const&, int, bool, bool, bool) src/item.cpp:11340
    #9 0x555558ef2e1b in insert_item_activity_actor::finish(player_activity&, Character&) src/activity_actor.cpp:3942
    #10 0x55555d7e3bff in player_activity::do_turn(Character&) src/player_activity.cpp:363
    #11 0x55555a5c797c in do_turn() src/do_turn.cpp:660
    #12 0x55555bd7fa35 in main src/main.cpp:766
    #13 0x7ffff6e7d0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)

previously allocated by thread T0 here:
    #0 0x7ffff768d587 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:104
    #1 0x555558fe804a in __gnu_cxx::new_allocator<std::_List_node<item> >::allocate(unsigned long, void const*) /usr/include/c++/9/ext/new_allocator.h:114
    #2 0x555558fd76a8 in std::allocator_traits<std::allocator<std::_List_node<item> > >::allocate(std::allocator<std::_List_node<item> >&, unsigned long) /usr/include/c++/9/bits/alloc_traits.h:443
    #3 0x555558fc2bdc in std::__cxx11::_List_base<item, std::allocator<item> >::_M_get_node() /usr/include/c++/9/bits/stl_list.h:438
    #4 0x555558fc6eb9 in std::_List_node<item>* std::__cxx11::list<item, std::allocator<item> >::_M_create_node<item const&>(item const&) /usr/include/c++/9/bits/stl_list.h:630
    #5 0x555558fae657 in void std::__cxx11::list<item, std::allocator<item> >::_M_insert<item const&>(std::_List_iterator<item>, item const&) /usr/include/c++/9/bits/stl_list.h:1907
    #6 0x555558f942c4 in void std::__cxx11::list<item, std::allocator<item> >::emplace_back<item const&>(item const&) /usr/include/c++/9/bits/stl_list.h:1223
    #7 0x55555906ddf4 in void std::__cxx11::list<item, std::allocator<item> >::_M_initialize_dispatch<std::_List_const_iterator<item> >(std::_List_const_iterator<item>, std::_List_const_iterator<item>, std::__false_type) /usr/include/c++/9/bits/stl_list.h:1836
    #8 0x55555905c721 in std::__cxx11::list<item, std::allocator<item> >::list(std::__cxx11::list<item, std::allocator<item> > const&) /usr/include/c++/9/bits/stl_list.h:734
    #9 0x55555b471fee in item_pocket::item_pocket(item_pocket const&) (/home/dtsadmin/Builds/Cataclysm-DDA/cataclysm-tiles+0x5f1dfee)
    #10 0x55555b47216c in void __gnu_cxx::new_allocator<std::_List_node<item_pocket> >::construct<item_pocket, item_pocket const&>(item_pocket*, item_pocket const&) /usr/include/c++/9/ext/new_allocator.h:146
    #11 0x55555b4596b6 in void std::allocator_traits<std::allocator<std::_List_node<item_pocket> > >::construct<item_pocket, item_pocket const&>(std::allocator<std::_List_node<item_pocket> >&, item_pocket*, item_pocket const&) /usr/include/c++/9/bits/alloc_traits.h:483
    #12 0x55555b442b5a in std::_List_node<item_pocket>* std::__cxx11::list<item_pocket, std::allocator<item_pocket> >::_M_create_node<item_pocket const&>(item_pocket const&) /usr/include/c++/9/bits/stl_list.h:633
    #13 0x55555b423873 in void std::__cxx11::list<item_pocket, std::allocator<item_pocket> >::_M_insert<item_pocket const&>(std::_List_iterator<item_pocket>, item_pocket const&) (/home/dtsadmin/Builds/Cataclysm-DDA/cataclysm-tiles+0x5ecf873)
    #14 0x55555b3e59ac in void std::__cxx11::list<item_pocket, std::allocator<item_pocket> >::emplace_back<item_pocket const&>(item_pocket const&) (/home/dtsadmin/Builds/Cataclysm-DDA/cataclysm-tiles+0x5e919ac)
    #15 0x55555b396e54 in void std::__cxx11::list<item_pocket, std::allocator<item_pocket> >::_M_initialize_dispatch<std::_List_const_iterator<item_pocket> >(std::_List_const_iterator<item_pocket>, std::_List_const_iterator<item_pocket>, std::__false_type) (/home/dtsadmin/Builds/Cataclysm-DDA/cataclysm-tiles+0x5e42e54)
    #16 0x55555b371583 in std::__cxx11::list<item_pocket, std::allocator<item_pocket> >::list(std::__cxx11::list<item_pocket, std::allocator<item_pocket> > const&) /usr/include/c++/9/bits/stl_list.h:734
    #17 0x55555b36b643 in item_contents::item_contents(item_contents const&) src/item_contents.h:30
    #18 0x55555b2253c9 in item::item(item const&) src/item.h:181
    #19 0x555558feb504 in void __gnu_cxx::new_allocator<std::_List_node<item> >::construct<item, item const&>(item*, item const&) /usr/include/c++/9/ext/new_allocator.h:146
    #20 0x555558fdb38e in void std::allocator_traits<std::allocator<std::_List_node<item> > >::construct<item, item const&>(std::allocator<std::_List_node<item> >&, item*, item const&) /usr/include/c++/9/bits/alloc_traits.h:483
    #21 0x555558fc6f2c in std::_List_node<item>* std::__cxx11::list<item, std::allocator<item> >::_M_create_node<item const&>(item const&) /usr/include/c++/9/bits/stl_list.h:633
    #22 0x555558fae657 in void std::__cxx11::list<item, std::allocator<item> >::_M_insert<item const&>(std::_List_iterator<item>, item const&) /usr/include/c++/9/bits/stl_list.h:1907
    #23 0x55555b7b0d9b in std::__cxx11::list<item, std::allocator<item> >::push_front(item const&) /usr/include/c++/9/bits/stl_list.h:1158
    #24 0x55555b79c098 in item_pocket::insert_item(item const&) src/item_pocket.cpp:1818
    #25 0x55555b4ee172 in item_contents::combine(item_contents const&, bool) src/item_contents.cpp:409
    #26 0x55555ddbd784 in item::deserialize(JsonObject const&) src/savegame_json.cpp:2976
    #27 0x555558f8d054 in std::enable_if<(!detail::IsJsonInDeserializable<item, void>::value)&&detail::IsJsonValueDeserializable<item, void>::value, bool>::type JsonIn::read<item>(item&, bool) src/json.h:430
    #28 0x555559b966c2 in decltype ((({parm#1}.front)()),(true)) JsonIn::read<std::__cxx11::list<item, std::allocator<item> >, (void*)0>(std::__cxx11::list<item, std::allocator<item> >&, bool) src/json.h:493
    #29 0x555559b92862 in bool JsonObject::read<std::__cxx11::list<item, std::allocator<item> > >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::list<item, std::allocator<item> >&, bool) const src/json.h:1186

SUMMARY: AddressSanitizer: heap-use-after-free src/item.h:181 in item::item(item const&)
Shadow bytes around the buggy address:
  0x0c2c80267900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80267910: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80267920: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80267930: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80267940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c2c80267950: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80267960: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80267970: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80267980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80267990: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
  0x0c2c802679a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==61526==ABORTING

Describe the solution

Prevent an item from showing up in the "insert item" list if the only available pocket is the pocket that already contains the item.

Describe alternatives you've considered

Limiting "insert" to just the top-level container.

Testing

Added a simple test case:

./tests/cata_test --rng-seed time "item cannot contain contents it already has"

Manual testing

With a half-filled bottle in a backpack:

Inserting into the backpack:

Without the fix

With the fix

Additional context