Fix client crash from DX primitive argument error leaks#5050
Open
HeresHavi wants to merge 1 commit into
Open
Conversation
Release primitive parsing and vertex allocations before raising Lua errors, preventing malformed primitive drawing calls from exhausting client memory.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixed native memory leaks on argument errors in:
dxDrawPrimitivedxDrawPrimitive3DdxDrawMaterialPrimitivedxDrawMaterialPrimitive3DTemporary parsing allocations and the heap-owned vertex vector are now released before the Lua error is raised. Valid drawing calls and their ownership flow remain unchanged.
Motivation
Lua uses
longjmpwhen raising errors, which skips C++ destructors. The primitive functions raised an error while their temporary number vector was still alive and without deleting the heap vertex vector.For example, a resource might leave a malformed
dxDrawPrimitivecall insideonClientRender. MTA catches the Lua error, so the render handler continues running and repeats the same leaking call every frame. Over time, this could exhaust the 32-bit client's address space and terminate the player with an Out of Memory error.Crash Stack
Test plan
Runtime
dxDrawPrimitivecall returnedtruebefore and after the fix.Expected table with 2 or 3 numbers, got 4 numbers.503.1 MiBto540.1 MiBafter two batches of 512 malformed calls.2953.3 MiB. A second batch exhausted the client and caused the fatal out-of-memory crash.515.2 MiB.655360calls. The client stayed responsive and settled at about521.2 MiBprivate memory.Builds and Tests
Debug | Win32:Client Deathmatchbuild passed.Release | Win32:Client Deathmatchbuild passed.clang-format.Checklist