[aron9forever]

I've discovered this thing accidentally while working on a plugin that uses the "F" key to open a menu.

Here's a video of me explaining and demonstrating it: https://www.youtube.com/watch?v=W_IOdW-qKec (make sure to set full quality, it's two screens so resolution is pretty big)

The script is the following:

#include <amxmodx>
#include <engine>

new g_team_menu;

public plugin_init() {
  register_impulse(100, "test_menu");

  g_team_menu = menu_create("Crash Menu", "test_menu_handler");
  menu_additem(g_team_menu, "lolwtf", "1", 0);
  menu_setprop(g_team_menu, MPROP_EXIT, MEXIT_ALL);
}

public test_menu(id) {
  menu_display(id, g_team_menu, 0);
}

public test_menu_handler(id, menu, item) {
  if(item == MENU_EXIT) {
    menu_destroy(menu);
    return PLUGIN_HANDLED;
  }

  return PLUGIN_HANDLED;
}

When pressing F two times in a row, the server crashes immediately.


Here is the full console output (including version, amxx version, meta version, meta list, amxx plugins) https://pastebin.com/2CLg6KaT


I have also encountered similar crashes on my production server which I have only reported here https://github.com/dreamstalker/rehlds/issues/522 because the post wouldn't comply with alliedmods' rules and I'm also running reHLDS (though on my local test server I am not)

[Arkshine]

Hm, just tried under windows, and the crash doesn't happen to me.

1.8.3-dev+5131, original HLDS (ReHLDS, and ReGameDLL as well), metamod-am, only this loaded plugin.

[Arkshine]

My bad, I was on an old branch. It crashes for me as well.

[aron9forever]

Originally Posted by Arkshine Hm, just tried under windows, and the crash doesn't happen to me. 1.8.3-dev+5131, original HLDS (ReHLDS, and ReGameDLL as well), metamod-am, only this loaded plugin.

Tried with metamod-am as well, it still happens.
I am running this under Ubuntu 16.04.3 LTS 64bit
HLDS is also original from steampipe though downloaded a while ago. It's basically a fresh install I created on a remote server to use as the "blank server" a hosting panel installs, kept it there for a while during which it was read only and then downloaded to my laptop. There are some random factors that shouldn't make a difference like the fact that it's on a windows partition, but that should clear if I can reproduce on production server.


I will test the issue on the production server mentioned on github as well, which runs on CentOS 6.9 and has reHLDS with same metamod-p and latest amxmodx

The weird thing is if I just put a dummy handler function to not get runtime errors, no params or any content, the crash never happens. I'm only opening the menu twice though, the handler shouldn't be called at all.

edit::
saw your reply late

edit2::
can confirm it also happens on CentOS 6.9 64bit with reHLDS

[Arkshine]

The issue is that menu_display tries to close/destroy the previous newmenu if it exists, before displaying the wanted menu, but in our situation, the previous menu is the same as the wanted menu. This results in a crash because the pointer to the menu has been deleted right before.

Typically:

- menu_create (handle: 0)

- menu_display 0
--- is there a previous menu? no

- menu_display 0 (the previous menu 0 not closed yet)
--- is there a previous menu? yes
------ closing menu and calling menu callback
---------- callback destroys menu 0
--- displaying menu 0
------ crash (menu is no more valid).


Usually, if you deal with a global menu, you don't use menu_destroy, but it should not crash.
At least menu_display should check if menu is still valid and throw an invalid menu error if needs.

[aron9forever]

Okay, I get it now, so this only affects dumbasses like me who free the pointer to a global menu and the other type of dumbasses who call menu_display in handler functions after destroying menus. I didn't take the time to learn what menu_destroy does, that's on me.

Thanks for clarifying, though I think amxmodx should gracefully handle as many such errors as possible.

[Arkshine]

A fix has been merged.