Duplicate_map server crashes after a while, please check src code

[herenow]

Well, i just discovered about the instance commands so i decided to create a "duplicate_map()" function based on that.

Im not a real pro SRC / C developer so im not sure if i did everything right, so here i am asking for the elite core developers of rathena to give my code a check.

The map-server crashes, after 1~2min i have duplicated 1000~1500 maps and filled in all map indexes spots. Not sure if that is the pattern of the crash.

Here is the code summary:

#define MAX_DUPLICATES_MAP 999 //real max_duplicates_map = 999, client crash if instance map ultrapasses dddd@map
int map_duplicates[MAX_MAP_PER_SERVER][MAX_DUPLICATES_MAP];

BUILDIN_FUNC(duplicate_map) {
int m, im, dm, i;
size_t num_cell, size;
const char *name;

name = script_getstr(st,2);
m = map_mapname2mapid(name);

if(m < 0) //map not found, cant duplicate
	return 0;

ARR_FIND( 0, MAX_DUPLICATES_MAP, dm, !map_duplicates[m][dm] );
if( dm >= MAX_DUPLICATES_MAP ) { //reached max duplicates
	ShowError("duplicate_map: mapid[%d] has reached its limit of duplicates.\n", m);
	script_pushconststr(st, "");
	return 0;
}

ARR_FIND( 0, map_num, i, !map[i].name[0] ); // Searching for a Free Map
if( i < map_num ) im = i; // Unused map found (old instance)
else if( map_num - 1 >= MAX_MAP_PER_SERVER ) { //No more free maps
	ShowError("duplicate_map: no more free space to create maps on this server.\n");
	script_pushconststr(st, "");
	return 0;
}
else im = map_num++; // Using next map index

memcpy( &map[im], &map[m], sizeof(struct map_data) ); // Copy source map
snprintf(map[im].name, MAP_NAME_LENGTH, "%.3d%s", dm, name); // Generate Name for Instance Map
map[im].index = mapindex_addmap(-1, map[im].name); // Add map index

if(!map[im].index) {
	map[im].name[0] = '\0';
	ShowError("duplicate_map: no more free map indexes.\n");
	script_pushconststr(st, "");
	return 0;
}

// Reallocate cells
num_cell = map[im].xs * map[im].ys;
CREATE( map[im].cell, struct mapcell, num_cell );
memcpy( map[im].cell, map[m].cell, num_cell * sizeof(struct mapcell) );

size = map[im].bxs * map[im].bys * sizeof(struct block_list*);
map[im].block = (struct block_list**)aCalloc(size, 1);
map[im].block_mob = (struct block_list**)aCalloc(size, 1);

memset(map[im].npc, 0x00, sizeof(map[i].npc));
map[im].npc_num = 0;

memset(map[im].moblist, 0x00, sizeof(map[im].moblist));
map[im].mob_delete_timer = INVALID_TIMER;

map[im].m = im;
map[im].duplicate_id = dm;
map[im].duplicate_src_map = m;

map_addmap2db(&map[im]);

//set map duplicated
map_duplicates[m][dm] = 1;

script_pushconststr(st, map[im].name);

return 0;
}

int warp2savepoint(struct map_session_data* sd, va_list args)
{
int m = va_arg(args,int);
if( !sd || sd->bl.m != m )
	return 0;

pc_setpos(sd, sd->status.save_point.map, sd->status.save_point.x, sd->status.save_point.y, CLR_OUTSIGHT);
return 1;
}

BUILDIN_FUNC(delete_map) {
int m;
const char *name;

name = script_getstr(st,2);
m = map_mapname2mapid(name);

if(m < 0) //map not found, cant delete
	return 0;

if(map[m].duplicate_src_map) { //is a duplicated map
	map_duplicates[map[m].duplicate_src_map][map[m].duplicate_id] = 0;
}

map_foreachpc(warp2savepoint, m);
map_foreachinmap(cleanup_sub, m, BL_ALL);

if(map[m].mob_delete_timer != INVALID_TIMER)
	delete_timer(map[m].mob_delete_timer, map_removemobs_timer);

mapindex_removemap(map[m].index);

// Free memory
aFree(map[m].cell);
aFree(map[m].block);
aFree(map[m].block_mob);

map_removemapdb(&map[m]);
memset(&map[m], 0x00, sizeof(map[0]));

script_pushint(st, 1);

return 0;
}

BUILDIN_FUNC(map_exists) {
if( map_mapname2mapid(script_getstr(st,2)) > 0 )
	script_pushint(st, 1);
return 0;
}

Thanks for the attention.

@edit

I think i got it.. Its cause i need to leave some free indexes for MAX_MAPINDEX, i had set MAX_MAP_PER_SERVER and MAX_MAPINDEX to the same value.

Am i correct?

@edit 23:59

-updated the code. havent had a crash since.

Edited July 6, 2012 by Tribbiani