Server crash when dropping weapons and using exhaustible weapons

[SamVanheer]

Players can crash a HLDM server, or any other Half-Life 1 based server that allows weapon dropping and is running a game that has exhaustible weapons with unmodified SDK code.

First, start a map that has both Snarks and Satchel Charges, like Crossfire.
You may also cheat using impulse 101, as long as it's a multiplayer server that allows weapon dropping.

Drop all weapons except the Satchel Charge and Snarks.
Switch between both to set one as the last weapon.
Deploy and detonate all Satchel Charges.
Throw all Snarks.
Use the lastinv command (Last Weapon Used keybind) to switch back to the previous weapon.
Pressing it again should cause a crash. This may require some timing to get the game's state exactly right.

The crash occurs when the weapon switching code tries to switch back to the Snarks after they've been removed (see

halflife/dlls/squeakgrenade.cpp

Line 486 in 5d76170

SetThink( &CSqueak::DestroyItem );

). Since they're set as both the active and last item, the last item pointer is not cleared.

To fix this, modify this line:

halflife/dlls/player.cpp

Line 3758 in 5d76170

else if ( m_pLastItem == pItem )

to become:

if ( m_pLastItem == pItem )

Reporting this issue makes it ripe for abuse, so for server operators that wish to avoid being targeted, set the cvar mp_weaponstay to 1. This will disable weapon dropping.

Original report from: https://facepunch.com/showthread.php?t=926172

[Enokilis]

Are issues here likely to get fixed? Will something finally be done about it after I attempted to bring it out seven years ago?

[SamVanheer]

Unlikely, but i alerted Valve to this issue directly. If they consider it to be important enough, they'll fix it.

[SamVanheer]

The latest beta on Steam fixes this issue.

[dannycolin]

They should at least inform us on github that there's a patch in the latest beta... Eh Valve! What's the point of using GitHub if you don't work with the community?

[SamVanheer]

An update has been released that fixes this exploit, however the SDK has not been updated to match the changes.

[Enokilis]

Servers are still not updated, and a part of me wants it to stay that way.
Okay, this was pretty mean of me.
https://www.youtube.com/watch?v=OLEdxduwcEY

[SamVanheer]

I guess i'll go ahead and close this now.