Skip to content

Fix collision UAF on paired time models#4864

Merged
Lpsd merged 1 commit into
multitheftauto:masterfrom
Zephkek:fix/timed-model-collision-uaf
Apr 30, 2026
Merged

Fix collision UAF on paired time models#4864
Lpsd merged 1 commit into
multitheftauto:masterfrom
Zephkek:fix/timed-model-collision-uaf

Conversation

@Zephkek
Copy link
Copy Markdown
Contributor

@Zephkek Zephkek commented Apr 30, 2026

Summary

  • Fix timed model collision restore desync that can leave dangling pColModel pointers and crash in CCollision::TestLineSphere at 0x4174B6.
  • Stop using GTA paired propagation in this path and sync paired TIME model collision state explicitly in MTA tracking.

Motivation

  • This is a long standing latent bug: after multiple model/COL replacements, reconnect is not enough and collision state can stay corrupted until full game restart.
  • Blame target for the broken behavior: 34b4a61d40b39e0f21f42ccf031d37439223fa12 (Resolve remaining collisionless objects (Fixes #927) (PR #2296)), which used paired SetColModel(..., true) without mirrored MTA tracking for the paired model.
  • Related but incomplete fix: c1824033c2e56db105730ed1cb0a06d7f720c042 (Fix timed-object collision crash (#4782)), which handled one path only.

Test plan

  • Repro sequence with two paired TIME models and two resources replacing/restoring COL in different order no longer leaves freed pointers bound.
  • Crash map/session hop flow that previously reached gta_sa.exe+0x174B6 no longer crashes in local validation run.
  • Non TIME model COL replacement/restore behavior stays unchanged.

Checklist

  • Your code should follow the coding guidelines.
  • Smaller pull requests are easier to review. If your pull request is beefy, your pull request should be reviewable commit-by-commit.

@Lpsd Lpsd merged commit 0f7294b into multitheftauto:master Apr 30, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants