[kadet.89]

I have a plugin which sometimes gives a weapon_healthshot item to a random player :

PHP Code:

int item = GivePlayerItem(client, "weapon_healthshot"); 


A few seconds after using this item my server crashes in about 1 out of 5 cases.

To analyse the problem I added a PlayerRunCmd prehook, where I iterate through m_hMyWeapons[64] of the player and print all not item_* and weapon_* entities.

Here is the log:

PHP Code:

L 06/15/2021 - 20:34:16: [test.smx] Give"weapon_healthshot" with index 138 to player Fin.
L 06/15/2021 - 20:39:16: [test.smx] Improper item "trigger_teleport " with index 138 in the invenory of Fin. 


The second line is printed in the PlayerRunCmd hook a few seconds after the player uses weapon_healthshot, then the server crashes.
My question is how such random items get to the inventory and why they have the same index as the weapon_healthshot which the plugin gives to players.
Is it caused by GivePlayerItem?

Yesterday I got a lot of "Improper..." for a player before the server crashed. Strange thing was that somewhere in the middle of the messages there were ~2 seconds without these logs and then all the rest "Improper..." were printed with another entity name. So the player at the begining had a weapon_healthshot in the inventory, then it was replaced to trigger_teleport and then to prop_dynamic_glow. The crash happend when the player left the game.

[Maxximou5]

You should get a crash log of what is happening in case it isn't directly that action, from Accelerator. However, from my experience, you need to use RequestFrame or a timer to give healthshots with the best results. Not sure if it remains the same, but it was either crashing or not giving the item. I setup my plugins to use the following -

PHP Code:

RequestFrame(Frame_GiveHealthshot, GetClientSerial(client));

public void Frame_GiveHealthshot(any serial)
{
    int client = GetClientFromSerial(serial)
    if (client > 0 && IsClientInGame(client) && IsPlayerAlive(client))
    {
        GivePlayerItem(client, "weapon_healthshot");
    }
} 


[kadet.89]

Here is the place where it crashes:

PHP Code:

void CBasePlayer::UpdateClientData( void )
{
    ....
    for ( int i = 0; i < WeaponCount(); i++ )
    {
        if ( GetWeapon(i) )
            GetWeapon(i)->UpdateClientData( this ); // SIGSEGV happens here as UpdateClientData is only avaliable for CBaseWeapon entities
    }
    ...
} 


It looks like pure entity index is saved to the CBaseHandle so that when the weapon is deleted the index is reused for another entity and thus it is valid again. What I don't understend is why it happens and why it happens only with weapon_healthshot entities. I only have outdated sources which don't give any clues.
In crashstack it looks like this server.so + 0xbaddea with sdkhooks.ext.2.csgo.so in the 4-th step as the call goes through PreThink->PlayerRunCmd. But it doesn't provide any information for the reason to be easily identified as the crash happens far away from the point when something goes wrong.

[micapat]

When are you trying to give the healthshot?

Use "SDKHook_SpawnPost" if at spawn.

[kadet.89]

They are given in 5 seconds after spawn.

[Maxximou5]

It would be helpful to provide your iteration code as well. Also, it would be good to know what game_type and game_mode you are using.

[kadet.89]

"game_type" = "0"
"game_mode" = "0"
Iteration code is written in c++:

PHP Code:

void CPlayer::OnPlayerRunCmd(CUserCmd* /*cmd*/, void* /*moveHelper*/)
{
    for(int i = 0; i != MAX_WEAPONS_CSGO; ++i)
    {
        CBaseEntity* weapon = GetMyWeaponHandle(i);
        if(!weapon)
            continue;

        std::string name(weapon->GetClassName());
        if (name.rfind("weapon_", 0) == 0)
            continue;

        if (name.rfind("item_", 0) == 0)
            continue;

        const int index = weapon->Index();

        LogMsg("Improper item \"%s\" with index %i in the invenory of %s", name.c_str(), index, GetName());
    }

    RETURN_META(MRES_IGNORED);
} 


Here is what under the hood of the GetMyWeaponHandle function:

PHP Code:

CFakeHandle& CBaseCombatCharacter::GetMyWeaponHandle(int index) const
{
    return m_hMyWeapons[index];
} 


PHP Code:

class CFakeHandle : public CBaseHandle
{
public:
    operator CBaseEntity* () const
    {
        if (!IsValid())
            return nullptr;

        const int index = GetEntryIndex();

        const cell_t ref = gamehelpers->IndexToReference(index);
        if(ref == -1)
            return nullptr;

        return gamehelpers->ReferenceToEntity(ref);
    }
}; 


[kadet.89]

I got new logs:

PHP Code:

L 06/17/2021 - 09:33:08: [TRIPMINES] Weapon classname: flashbang_projectile handlindex (reference): 471007374 index: 142 serial number: 7187 entry index 142 player: Derby
L 06/17/2021 - 09:33:20: [TRIPMINES] Weapon classname: prop_dynamic handlindex (reference): 471007374 index: 142 serial number: 7187 entry index 142 player: Derby 


Looks like after weapon_healthshot is deleted, another entity is created with the same serial number (the same reference) and it happens again if that new entity is deleted.

[micapat]

Post your plugin code.

"GivePlayerItem(client, "weapon_healthshot");" should work without any problem with game_type/mode 0.

What're u doing with the "item" returned by GivePlayerItem() ?

[kadet.89]

I'm away now, can't share the code. But it's as simple as possible.
There is a player spawn hook with a 5sec timer. In the timer callback function the player (if still exists) is given 1 such item. I get the index, but don't do anything with it.
I doubt that it is possible to create such a serious bug with sourcepawn code. That must be something wrong on the engine level. Beside, I have other plugins wich use GivePlayerItem with other item types and it doesn't lead to this problem.