Skip to content

Fix client crash when reading deeply nested Lua tables#5051

Open
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-lua-table-depth-crash
Open

Fix client crash when reading deeply nested Lua tables#5051
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-lua-table-depth-crash

Conversation

@HeresHavi

@HeresHavi HeresHavi commented Jul 13, 2026

Copy link
Copy Markdown

Summary

Added a 64-level nesting limit to the client and server Lua table readers.

Failed reads now stop safely, clean up partially copied arguments, and return a normal Lua error instead of continuing with invalid stack data.

Motivation

toJSON copies Lua tables into native arguments before serializing them. A deeply nested but valid table could exceed the Lua stack limit, but the failed stack check was ignored. The next lua_pushnil call then accessed invalid memory and crashed the client.

For example, a client resource might build or receive a deeply nested configuration table and pass it to toJSON. If the table contains enough nested levels, the resource could crash the player's client instead of receiving a normal error.

Crash Stack
Exception: Access violation

lua_pushnil (vendor/lua/src/lapi.c:458)
CLuaArguments::ReadTable (Client/mods/deathmatch/logic/lua/CLuaArguments.cpp:110)
CLuaArgument::Read (Client/mods/deathmatch/logic/lua/CLuaArgument.cpp:255)
CLuaArgument::CLuaArgument (Client/mods/deathmatch/logic/lua/CLuaArgument.cpp:62)
CLuaArguments::ReadTable (Client/mods/deathmatch/logic/lua/CLuaArguments.cpp:120)
... repeated for nested table levels ...
Crash

Test plan

Runtime

  • Before Fix: Passing a 4,096-level table to toJSON caused an access violation in lua_pushnil.
  • After Fix: The same table returned nil in 0 ms, and the client stayed open.
  • Valid Case: A 16-level table returned the same 177-byte JSON string as before.
  • Accepted Boundary: A table with 64 total table objects returned a 647-byte JSON string.
  • Rejected Boundary: A table with 65 total table objects returned nil, and the client stayed open.

Builds and Tests

  • Debug | Win32: Full build passed.
  • Debug | x64: Full build passed.
  • Ran clang-format.

Checklist

  • Your code should follow the coding guidelines.
  • Smaller pull requests are easier to review. If your pull request is beefy, your pull request should be reviewable commit-by-commit.

Limit recursive Lua table argument reads and safely reject excessive nesting before it can exhaust the Lua or native stack.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant