Skip to content

fix(w3dmodeldraw): Prevent null dereference in W3DModelDraw::handleClientRecoil() - #3301

Open
CryoTheRenegade wants to merge 1 commit into
TheSuperHackers:mainfrom
CryoTheRenegade:bugfix/clang-tidy-model-recoil-null-state
Open

CryoTheRenegade wants to merge 1 commit into
TheSuperHackers:mainfrom
CryoTheRenegade:bugfix/clang-tidy-model-recoil-null-state

Conversation

@CryoTheRenegade

Copy link
Copy Markdown

Fixes a null-pointer dereference when drawing a model without a current model state. handleClientRecoil() previously read m_curState->m_validStuff even when m_curState was null.

Found by clang-tidy

@CryoTheRenegade
CryoTheRenegade marked this pull request as ready for review September 15, 2026 20:27
@coderabbitai

coderabbitai Bot commented Sep 15, 2026

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: afb9d98f-e0fc-4fd4-9203-5abd3229c4a7

📥 Commits

Reviewing files that changed from the base of the PR and between 4f3482d and b46e669.

📒 Files selected for processing (1)
  • Core/GameEngineDevice/Source/W3DDevice/GameClient/Drawable/Draw/W3DModelDraw.cpp

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.


Walkthrough

handleClientRecoil now checks that the current model condition state exists before accessing barrel data. Recoil and muzzle flash processing continues only when both state and barrel data are valid.

Changes

Recoil handling safety

Layer / File(s) Summary
Validate recoil state
Core/GameEngineDevice/Source/W3DDevice/GameClient/Drawable/Draw/W3DModelDraw.cpp
handleClientRecoil now requires a non-null current state and valid barrel data before processing recoil and muzzle flashes.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b46e6

The recoil path safely skips processing without a model state, with no remaining merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly identifies the null dereference fix in W3DModelDraw::handleClientRecoil().
Description check ✅ Passed The description explains the null-pointer dereference, the affected function, the cause, and the clang-tidy finding.

Comment @coderabbitai help to get the list of available commands.

@greptile-apps

greptile-apps Bot commented Sep 15, 2026

Copy link
Copy Markdown

Greptile Summary

This PR prevents handleClientRecoil() from dereferencing a null current model state.

  • Adds an early return when m_curState is null.
  • Preserves the existing barrel-validity check and all behavior for non-null states.

Confidence Score: 5/5

The PR appears safe to merge and directly prevents the reported null-pointer dereference without changing valid-state behavior.

The raw pointer null check short-circuits before member access, while existing behavior is preserved whenever a current state exists; no actionable regressions or rule violations were found.

Important Files Changed

Filename Overview
Core/GameEngineDevice/Source/W3DDevice/GameClient/Drawable/Draw/W3DModelDraw.cpp Adds a correctly short-circuited null guard before accessing the current model state's barrel metadata.

Reviews (1): Last reviewed commit: "fix(W3DDevice): Return from handleClient..." | Re-trigger Greptile

@bobtista bobtista left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM good find. Maybe add labels to the PR, and did clang-tidy find a bunch more like this? If so, could make another PR with many of the same kind of change

@CryoTheRenegade

Copy link
Copy Markdown
Author

Clang-Tidy found a bunch, but I feel that a lot of them are not 100% accurate so i'm slowly running through a list to see if anything pops out at me before bulk applying fixes that may not be needed.

@@ -2496,7 +2496,7 @@ void W3DModelDraw::handleClientTurretPositioning()
void W3DModelDraw::handleClientRecoil()
{
const W3DModelDrawModuleData* d = getW3DModelDrawModuleData();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While at it, also move this past the return.

@xezon xezon added Minor Severity: Minor < Major < Critical < Blocker Gen Relates to Generals ZH Relates to Zero Hour Fix Is fixing something, but is not user facing Stability Concerns stability of the runtime labels Sep 16, 2026
@xezon xezon added this to the Stability fixes milestone Sep 16, 2026
@xezon xezon changed the title fix(W3DDevice): Return from handleClientRecoil() when m_curState is null fix(w3dmodeldraw): Avoid null dereference in W3DModelDraw::handleClientRecoil() Sep 16, 2026
@xezon xezon changed the title fix(w3dmodeldraw): Avoid null dereference in W3DModelDraw::handleClientRecoil() fix(w3dmodeldraw): Prevent null dereference in W3DModelDraw::handleClientRecoil() Sep 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Fix Is fixing something, but is not user facing Gen Relates to Generals Minor Severity: Minor < Major < Critical < Blocker Stability Concerns stability of the runtime ZH Relates to Zero Hour

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants