Valve/source-sdk-2013
1
0
Fork 0
mirror of https://github.com/ValveSoftware/source-sdk-2013.git synced 2025-01-13 23:38:04 +03:00
Code Issues Packages Projects Releases Wiki Activity

Client Crash: Creating bugbait at particle limit

Browse Source 
Crash in client.dll via dangling pointer dereference when bugbait's spore particle effect is created when at the old particle system's max particle limit.
SporeEffect object needed to be wrapped in CSmartPtr<>, just as the other particle objects are in the same file.
CSmartPtr allows detection to check if the child particle effect was freed. Just as the other effects do.
Added similar null checks missing in OnDataChanged() and AddParticles()
Appears to be a simple oversight.

Discovered: Played with around 50 players on server. Many throwing bugbait. Gathered crash dumps from some affected players.
Test Case: Spawn around ~40 bots, bot_mimic 1, give weapon_bugbait, throw a few bugbaits to quickly induce crash
This commit is contained in:
Travis Wehrman 2023-04-02 15:41:41 -05:00
parent 0d8dceea43
commit b2caee3f2a
4 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
mp/src/game/client/c_smoke_trail.cpp
View File

@ -950,7 +950,10 @@ void C_SporeExplosion::OnDataChanged( DataUpdateType_t updateType )
m_teParticleSpawn.Init( m_flSpawnRate );
}
m_pSporeEffect->SetDontRemove( m_bDontRemove );
if( m_pSporeEffect.IsValid() )
{
m_pSporeEffect->SetDontRemove( m_bDontRemove );
}
}
//-----------------------------------------------------------------------------
@ -981,6 +984,11 @@ void C_SporeExplosion::Start( CParticleMgr *pParticleMgr, IPrototypeArgAccess *p
//-----------------------------------------------------------------------------
void C_SporeExplosion::AddParticles( void )
{
if( !m_pSporeEffect )
{
return;
}
//Spores
Vector offset;
Vector dir;

2
mp/src/game/client/c_smoke_trail.h
View File

@ -249,7 +249,7 @@ private:
PMaterialHandle m_hMaterial;
TimedEvent m_teParticleSpawn;
SporeEffect *m_pSporeEffect;
CSmartPtr<SporeEffect> m_pSporeEffect;
CParticleMgr *m_pParticleMgr;
};

10
sp/src/game/client/c_smoke_trail.cpp
View File

@ -950,7 +950,10 @@ void C_SporeExplosion::OnDataChanged( DataUpdateType_t updateType )
m_teParticleSpawn.Init( m_flSpawnRate );
}
m_pSporeEffect->SetDontRemove( m_bDontRemove );
if( m_pSporeEffect.IsValid() )
{
m_pSporeEffect->SetDontRemove( m_bDontRemove );
}
}
//-----------------------------------------------------------------------------
@ -981,6 +984,11 @@ void C_SporeExplosion::Start( CParticleMgr *pParticleMgr, IPrototypeArgAccess *p
//-----------------------------------------------------------------------------
void C_SporeExplosion::AddParticles( void )
{
if( !m_pSporeEffect )
{
return;
}
//Spores
Vector offset;
Vector dir;

2
sp/src/game/client/c_smoke_trail.h
View File

@ -249,7 +249,7 @@ private:
PMaterialHandle m_hMaterial;
TimedEvent m_teParticleSpawn;
SporeEffect *m_pSporeEffect;
CSmartPtr<SporeEffect> m_pSporeEffect;
CParticleMgr *m_pParticleMgr;
};