Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: crash from invalid weapon access and fixes ValveSoftware#3819 #3820

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

0Ky
Copy link

@0Ky 0Ky commented Sep 5, 2024

Description

This pull request fixes a crash that was introduced in the 25th Anniversary Update of Half-Life, which occurs when a player dies while switching to a weapon that has run out of ammo. The crash stems from an invalid dereference of a null pointer when attempting to pack the dead player's weapons into a weapon box. Specifically, rgpPackWeapons[0] is null, leading to an invalid pev access.

After extensive tracing, the root cause of the issue has been identified when switching back to a weapon with zero ammo, the weapon's Holster() function calls the following chain of events:

DestroyItem() -> RemovePlayerItem() -> m_pActiveItem = NULL

Related Issue

Fixes issue #3819

Explanation of Changes

  • Added a check for m_pActiveItem to prevent dereferencing a null pointer when packing dead player's weapons

    The crash occurs due to an invalid pev pointer, where rgpPackWeapons[0] is NULL while attempting to dereference it. Upon death, rgpPackWeapons[nIndex] = pWeapon is never assigned because it is inside a condition that checks whether m_pActiveItem is not NULL.

    The chain leading to m_pActiveItem being NULL starts when a weapon is switched back to with 0 ammo. When this happens, the weapon's Holster() function calls DestroyItem(), which in turn calls RemovePlayerItem(). This function sets m_pActiveItem = NULL, meaning that when the player dies or kills themselves, the PackDeadPlayerItems() function doesn't assign pWeapon to rgpPackWeapons[nIndex]. As a result, rgpPackWeapons[0] remains NULL, leading to the crash when trying to dereference rgpPackWeapons[0]->pev.

  • Added a validation in CBasePlayer::SelectItem and CBasePlayer::SelectLastItem to ensure the selected weapon can be deployed before switching to it.

    The issue is also caused by players switching to unusable weapons (such as one with no ammo or one that has been destroyed), leading to crashes and unexpected behavior described in issue [HL25] Weapon model desync when switching while +attack held #3819. Adding CanDeploy() validation ensures that the player only switches to valid, deployable weapons. This prevents crashes due to switching to weapons that cannot be used (e.g., no ammo or destroyed weapons), avoiding invalid weapon access issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant