Skip to content

Fix crash when assigning invalid model TXD IDs#5041

Open
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-invalid-model-txd-id
Open

Fix crash when assigning invalid model TXD IDs#5041
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-invalid-model-txd-id

Conversation

@HeresHavi

@HeresHavi HeresHavi commented Jul 12, 2026

Copy link
Copy Markdown

Summary

Added TXD slot validation to engineSetModelTXDID and made the pool availability check bounds safe.

Invalid or unallocated TXD IDs are now rejected before the model or its reference counts are changed.

Motivation

engineSetModelTXDID checked the model ID but accepted any unsigned 16-bit TXD ID. This allowed an unavailable slot to remain stored on a loaded model. A later operation such as engineGetModelTextureNames could pass that ID into GTA's unchecked TXD lookup and crash the client.

For example, a resource might cache a TXD ID so it can update a player model later. If that slot was released during a resource restart, reusing the stale ID could leave the model pointing at missing TXD data. The next texture query could then crash the player.

Valid IDs returned by engineRequestTXD are still accepted.

Crash Stack
Exception: Access violation
Module: gta_sa.exe
Offset: 0x003F3737

CRenderWareSA::GetModelTextureNames (CRenderWareSA.cpp:786)
CLuaEngineDefs::EngineGetModelTextureNames (CLuaEngineDefs.cpp:1457)
Crash

Test plan

Runtime

  • Before Fix: TXD ID 65535 was accepted for a loaded model, and querying its texture names caused an access violation in GTA's TXD lookup.
  • After Fix: The invalid ID was rejected, the original TXD remained assigned, and texture names could still be queried safely.
  • Valid Case: The model's existing TXD and a new slot returned by engineRequestTXD were both accepted.
  • Stale Case: An allocated slot was released through resource teardown, and its old in-range ID was rejected without changing the model.

Builds and Tests

  • Debug | Win32: Solution build passed, 304 client tests passed.
  • Release | Win32: Solution build passed, 304 client tests passed.
  • Ran clang-format.

Checklist

  • Your code should follow the coding guidelines.
  • Smaller pull requests are easier to review. If your pull request is beefy, your pull request should be reviewable commit-by-commit.

Reject unavailable TXD pool slots before changing a model's texture
dictionary. This prevents invalid IDs from reaching GTA's unchecked
TXD lookup and causing a client crash during later texture operations.
@HeresHavi HeresHavi closed this Jul 12, 2026
@HeresHavi HeresHavi deleted the fix-invalid-model-txd-id branch July 12, 2026 23:54
@HeresHavi HeresHavi restored the fix-invalid-model-txd-id branch July 13, 2026 00:12
@HeresHavi HeresHavi reopened this Jul 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant