Skip to content

Fix client crash on oversized building pool resize#5046

Open
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-building-pool-resize-crash
Open

Fix client crash on oversized building pool resize#5046
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-building-pool-resize-crash

Conversation

@HeresHavi

@HeresHavi HeresHavi commented Jul 13, 2026

Copy link
Copy Markdown

Summary

Added upper-bound and allocation checks to building pool resizing.

Replacement storage is now allocated before the active GTA pool is freed. Failed resize requests return false without removing the world or leaving stale building pointers behind.

Motivation

An oversized engineSetPoolCapacity request could remove the game world and free the active building pool before all replacement allocations had succeeded. If a later allocation failed, the rollback path could not safely repair existing world references.

For example, a resource might increase the building pool for a large custom map. If its capacity calculation produces an extremely large value, the old resize path could leave roads and buildings missing or crash the player's client during the next world update.

The fix rejects sizes that cannot fit GTA's signed pool capacity and handles allocation failures before changing the active pool.

Crash Stack
Exception: Access violation
Module: gta_sa.exe
Offset: 0x0000620B

HOOK_FreezeFix_Misc15 (CMultiplayerSA_CrashFixHacks.cpp:683)
HOOK_CStreaming_Update_Caller (CMultiplayerSA.cpp:2904)
CGameProcessWithTiming (CMultiplayerSA.cpp:5430)
HOOK_Idle (CMultiplayerSA.cpp:5458)
HOOK_CallIdle (CMultiplayerSA_Rendering.cpp:65)
Crash

Test plan

Runtime

  • Valid Case: Increased the building pool from 13000 to 13001, then restored it to 13000. Both calls returned true.
  • Before Fix: Capacity 2147483648 raised vector too long after removing the world. Roads and buildings disappeared even though the capacity still reported 13000.
  • Before Fix: Capacity 200000000 left stale world pointers and caused an access violation during a later GTA update.
  • After Fix: Both oversized values returned false, retained capacity 13000, and the client stayed open.
  • World Check: Buildings, roads, collision, driving, flying, and vehicle interaction continued working after both rejected calls.

Builds and Tests

  • Debug | Win32: Build passed, 304 client tests passed.
  • Release | Win32: Build passed, 304 client tests passed.
  • Debug | x64: Build passed.
  • Release | x64: Build passed.
  • Ran clang-format.

Checklist

  • Your code should follow the coding guidelines.
  • Smaller pull requests are easier to review. If your pull request is beefy, your pull request should be reviewable commit-by-commit.

Prevent oversized engineSetPoolCapacity requests from leaving the building pool in a partially replaced state.

Validate capacities before destructive lifecycle work, guard allocation-size calculations, and allocate all replacement pool storage before freeing the active GTA pool. Allocation failures now return safely without leaving stale world pointers or removing the game world.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant