Skip to content

Fix client crash when loading malformed IFP animation data#5047

Open
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-ifp-animation-count-crash
Open

Fix client crash when loading malformed IFP animation data#5047
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-ifp-animation-count-crash

Conversation

@HeresHavi

@HeresHavi HeresHavi commented Jul 13, 2026

Copy link
Copy Markdown

Summary

Added ANP2 and ANP3 validation before constructing animation hierarchies.

Malformed animation counts, object counts, frame counts, frame types, truncated headers, and missing frame data now return false. Allocation failures during the initial animation resize are also handled safely.

Motivation

CClientIFP::ReadIFPVersion2 passed the signed TotalAnimations value directly to std::vector::resize. A value of -1 became an extremely large unsigned size and caused an uncaught std::length_error to terminate the client.

For example, a resource might load a custom animation file downloaded with a character pack. If the file is corrupted or has an invalid animation count, simply calling engineLoadIFP could crash the player before the animation was even applied.

The validation runs once when the IFP is loaded and does not add work to animation playback.

Crash Stack
RaiseException
_CxxThrowException
std::_Xlength_error
std::vector<...>::_Resize_reallocate
std::vector<...>::resize
CClientIFP::ReadIFPVersion2 (CClientIFP.cpp:128)
CClientIFP::Load (CClientIFP.cpp:58)
CIFPEngine::LoadIFP (CIFPEngine.cpp:27)
CLuaEngineDefs::EngineLoadIFP (CLuaEngineDefs.cpp:545)
Crash

Test plan

Runtime

  • Valid Case: A 36-byte ANP2 file declaring zero animations returned a valid IFP element before and after the fix.
  • Before Fix: The same file with TotalAnimations = -1 caused an uncaught std::length_error and terminated the client.
  • After Fix: The negative animation count returned false, and the client stayed open.
  • Truncated Header: Declaring one animation without its header returned false.
  • Invalid Object Count: One animation with TotalObjects = -1 returned false.
  • Missing Frame Data: One sequence declaring a frame without its payload returned false.

Builds and Tests

  • Debug | Win32: Full build passed, 304 client tests passed.
  • Release | Win32: Full build passed, 304 client tests passed.
  • Debug | x64: Full build passed.
  • Release | x64: Full build passed.
  • Ran clang-format.

Checklist

  • Your code should follow the coding guidelines.
  • Smaller pull requests are easier to review. If your pull request is beefy, your pull request should be reviewable commit-by-commit.

Validate ANP2 and ANP3 animation metadata and buffer bounds before parsing to prevent malformed IFP files from causing client crashes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant