Crash in client.dll via dangling pointer dereference when bugbait's spore particle effect is created when at the old particle system's max particle limit. SporeEffect object needed to be wrapped in CSmartPtr<>, just as the other particle objects are in the same file. CSmartPtr allows detection to check if the child particle effect was freed. Just as the other effects do. Added similar null checks missing in OnDataChanged() and AddParticles() Appears to be a simple oversight.
Discovered: Played with around 50 players on server. Many throwing bugbait. Gathered crash dumps from some affected players.
Test Case: Spawn around ~40 bots, bot_mimic 1, give weapon_bugbait, throw a few bugbaits to quickly induce crash
Crash in client.dll via dangling pointer dereference when bugbait's spore particle effect is created when at the old particle system's max particle limit. SporeEffect object needed to be wrapped in CSmartPtr<>, just as the other particle objects are in the same file. CSmartPtr allows detection to check if the child particle effect was freed. Just as the other effects do. Added similar null checks missing in OnDataChanged() and AddParticles() Appears to be a simple oversight.
Discovered: Played with around 50 players on server. Many throwing bugbait. Gathered crash dumps from some affected players. Test Case: Spawn around ~40 bots, bot_mimic 1, give weapon_bugbait, throw a few bugbaits to quickly induce crash