Skip to content

Fix client crash from invalid COL header sizes#5045

Open
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-invalid-col-header-size
Open

Fix client crash from invalid COL header sizes#5045
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-invalid-col-header-size

Conversation

@HeresHavi

@HeresHavi HeresHavi commented Jul 13, 2026

Copy link
Copy Markdown

Summary

Added COL size validation to CRenderWareSA::ReadCOL before creating a collision model or calling GTA's parser.

Malformed entries are now rejected when the declared size is too small, extends beyond the supplied buffer, or cannot contain the required COL2 or COL3 header.

Motivation

CRenderWareSA::ReadCOL subtracted the 24-byte model-name section from the declared COL size without checking it first. A declared size below 24 could underflow into a very large unsigned value and be passed to GTA.

For example, a resource might load custom collision data downloaded with a map. If that data is truncated or has a broken size field, calling engineLoadCOL could send the invalid length into GTA's collision parser and crash the player's client.

The validated size is now reused when calling GTA, while COL archives containing trailing entries remain supported.

Crash Stack
Exception: Access violation
Code: 0xC0000005
Module: gta_sa.exe
Module offset: 0x00137F77
Address: 0x537F77

0x537F77 is inside LoadCollisionModelVer2
Crash

Test plan

Runtime

  • Valid Case: A known valid repository COL file returned a valid element before and after the fix.
  • Before Fix: A 48-byte COL2 buffer with a declared size of zero caused an access violation inside LoadCollisionModelVer2.
  • After Fix: The exact same malformed buffer returned false, and the client stayed open.

Builds and Tests

  • Debug | Win32: Game SA build passed.
  • Release | Win32: Game SA build passed.
  • Ran clang-format.

Checklist

  • Your code should follow the coding guidelines.
  • Smaller pull requests are easier to review. If your pull request is beefy, your pull request should be reviewable commit-by-commit.

Reject truncated or underflowing COL entries before passing their data to
GTA's collision parsers. Preserve support for COL archives containing
trailing entries.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant