Skip to content

Fix crash when playing SFX with invalid audio indices#5043

Open
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-sfx-audio-index-crash
Open

Fix crash when playing SFX with invalid audio indices#5043
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-sfx-audio-index-crash

Conversation

@HeresHavi

@HeresHavi HeresHavi commented Jul 13, 2026

Copy link
Copy Markdown

Summary

Added sound index and archive metadata checks before accessing the fixed-size SFX table.

Invalid playSFX and playSFX3D calls now return false instead of reading unrelated memory or crashing the client.

Motivation

The SFX reader accessed bankHeader.sounds[audioIndex] before checking whether the index was valid. A far-out negative index could point outside the table and cause an access violation while reading the sound metadata.

For example, a resource might choose an SFX index from a configuration file or generated list. If that value becomes negative or exceeds the number of sounds in the bank, playing it could crash the player's client.

The reader now also checks the archive sound count and offsets before calculating the sound length. This prevents invalid archive metadata from producing another out-of-bounds read or unsigned length error.

Crash Stack
Exception: Access violation

playSFX("genrl", 0, -10000000, false)

CAudioContainerSA::GetRawAudioData (CAudioContainerSA.cpp:127)
CAudioContainerSA::GetAudioData
CClientSoundManager::PlayGTASFX
CStaticFunctionDefinitions::PlaySFX
CLuaAudioDefs::PlaySFX
Crash

Test plan

Runtime

  • Before Fix: playSFX("genrl", 0, -10000000, false) caused an access violation in CAudioContainerSA::GetRawAudioData.
  • After Fix: playSFX returned false for indices -1 and -10000000, and the client stayed open.
  • 3D Case: playSFX3D returned false for index -10000000.
  • Valid Case: Normal playSFX and playSFX3D playback still returned sound elements.

Builds and Tests

  • Debug | Win32: Full build passed, 304 client tests passed.
  • Release | Win32: Full build passed, 304 client tests passed.
  • Ran clang-format.

Checklist

  • Your code should follow the coding guidelines.
  • Smaller pull requests are easier to review. If your pull request is beefy, your pull request should be reviewable commit-by-commit.

playSFX and playSFX3D accepted sound numbers outside the available list. A sufficiently large negative number caused the client to read invalid memory and crash.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant