Skip to content

fix(gta-core-five): bound-check scenario point ped model set index - #4124

Open
DaniGP17 wants to merge 1 commit into
citizenfx:masterfrom
DaniGP17:fix/ambient-model-set-oob
Open

fix(gta-core-five): bound-check scenario point ped model set index#4124
DaniGP17 wants to merge 1 commit into
citizenfx:masterfrom
DaniGP17:fix/ambient-model-set-oob

Conversation

@DaniGP17

Copy link
Copy Markdown
Contributor

Goal of this PR

CScenarioPoint::GetModelSetIndex() indexes m_ModelSets[kVehicleModelSets] for vehicle scenario points and m_ModelSets[kPedModelSets] for everything else, with no bounds check. Two call sites use it as a ped index without guarding on the scenario type, so a streamed AMBIENT_VEHICLE_MODEL_SET_FILE that grows the vehicle set count past the ped set count turns the mismatch into an OOB read.

Also fixes CAmbientModelSets::Append() nulling every model's Variations right after adopting it, which made resources streaming vehiclemodelsets.meta spawn the correct vehicle but always stock (mods/colours/livery never apply).

Used this resource for testing: https://github.com/lkid73/sete_le

How is this PR achieving the goal

Bound-checks CScenarioPoint::GetModelSetIndex() before it's used as a ped model set index, fixing an OOB read crash when a resource streams enough vehicle model sets to overflow the ped array.

Removes a ReleaseVariations() call in CAmbientModelSets::Append() that was nulling vehicle mods/colours/livery on load, so streamed vehicle model sets stopped spawning stock.

This PR applies to the following area(s)

FiveM

Successfully tested on

Game builds: 3407

Platforms: Windows

Checklist

  • Code compiles and has been tested successfully.
  • Code explains itself well and/or is documented.
  • My commit message explains what the changes do and what they are for.
  • No extra compilation warnings are added by these changes.

Fixes issues

fixes #3473

@github-actions github-actions Bot added the invalid Requires changes before it's considered valid and can be (re)triaged label Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

invalid Requires changes before it's considered valid and can be (re)triaged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

vehiclemodelset.meta file isn't read properly and causes crashes.

1 participant