From cad9848244724842b1a14400ccb900aba829e28d Mon Sep 17 00:00:00 2001 From: Flashmyname Date: Thu, 10 Sep 2026 17:47:38 +0200 Subject: [PATCH] Fix use-after-free of the clothes TXD buffer after engineImportTXD --- Client/mods/deathmatch/logic/CClientTXD.cpp | 6 +++++- Client/mods/deathmatch/logic/CClientTXD.h | 6 +++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/Client/mods/deathmatch/logic/CClientTXD.cpp b/Client/mods/deathmatch/logic/CClientTXD.cpp index 544fa3f293f..bf263795d3a 100644 --- a/Client/mods/deathmatch/logic/CClientTXD.cpp +++ b/Client/mods/deathmatch/logic/CClientTXD.cpp @@ -70,7 +70,11 @@ bool CClientTXD::AddClothingTexture(const std::string& modelName) return false; } - return g_pGame->GetRenderWare()->ClothesAddFile(m_FileData.data(), m_FileData.size(), modelName.c_str()); + if (!g_pGame->GetRenderWare()->ClothesAddFile(m_FileData.data(), m_FileData.size(), modelName.c_str())) + return false; + + m_bUsingFileDataForClothes = true; + return true; } bool CClientTXD::Import(unsigned short usModelID) diff --git a/Client/mods/deathmatch/logic/CClientTXD.h b/Client/mods/deathmatch/logic/CClientTXD.h index a43ea97a367..e89d6847329 100644 --- a/Client/mods/deathmatch/logic/CClientTXD.h +++ b/Client/mods/deathmatch/logic/CClientTXD.h @@ -40,9 +40,9 @@ class CClientTXD final : public CClientEntity bool GetFilenameToUse(SString& strOutFilename); SString m_strFilename; - bool m_bFilteringEnabled; - bool m_bIsRawData; - bool m_bUsingFileDataForClothes; + bool m_bFilteringEnabled = false; + bool m_bIsRawData = false; + bool m_bUsingFileDataForClothes = false; SString m_FileData; SReplacementTextures m_ReplacementTextures; };