Skip to content

fix(modeldraw): Prevent null dereference in W3DModelDraw::handleClientRecoil() - #3301

Open
CryoTheRenegade wants to merge 2 commits into
TheSuperHackers:mainfrom
CryoTheRenegade:bugfix/clang-tidy-model-recoil-null-state
Open

CryoTheRenegade wants to merge 2 commits into
TheSuperHackers:mainfrom
CryoTheRenegade:bugfix/clang-tidy-model-recoil-null-state

Conversation

@CryoTheRenegade

Copy link
Copy Markdown

Fixes a null-pointer dereference when drawing a model without a current model state. handleClientRecoil() previously read m_curState->m_validStuff even when m_curState was null.

Found by clang-tidy

@CryoTheRenegade
CryoTheRenegade marked this pull request as ready for review September 15, 2026 20:27
@coderabbitai

coderabbitai Bot commented Sep 15, 2026

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: df612f56-c63d-4e63-a043-bb59243ad0a6

📥 Commits

Reviewing files that changed from the base of the PR and between b46e669 and 62f3dbf.

📒 Files selected for processing (1)
  • Core/GameEngineDevice/Source/W3DDevice/GameClient/Drawable/Draw/W3DModelDraw.cpp

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.


Walkthrough

handleClientRecoil now validates the current model state and barrel data before it retrieves module data or processes recoil and muzzle flashes.

Changes

Recoil handling safety

Layer / File(s) Summary
Validate recoil state
Core/GameEngineDevice/Source/W3DDevice/GameClient/Drawable/Draw/W3DModelDraw.cpp
handleClientRecoil returns when the current state or barrel data is invalid. It accesses module data only after these checks.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 62f3d

The change safely skips recoil processing until valid state and barrel data exist, with no concrete merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
Check name Status Explanation
Description check ✅ Passed The description clearly explains the null-pointer dereference fix in W3DModelDraw::handleClientRecoil() and identifies clang-tidy as the source of the issue.
Title check ✅ Passed The title clearly and concisely identifies the null-dereference fix in W3DModelDraw::handleClientRecoil().
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

Comment @coderabbitai help to get the list of available commands.

@greptile-apps

greptile-apps Bot commented Sep 15, 2026

Copy link
Copy Markdown

RetriggerConfidence Score: 5/5

The PR appears safe to merge; the guard prevents the reported null dereference without changing valid recoil processing.

Summary

This PR prevents W3DModelDraw::handleClientRecoil() from dereferencing a null current model state.

  • Returns before reading m_curState->m_validStuff when m_curState is null.
  • Preserves the existing BARRELS_VALID check.
  • Defers retrieving module data until recoil processing can proceed.

Reviews (2) · Last reviewed commit: "fix(w3dmodeldraw): Move past return"

@bobtista bobtista left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM good find. Maybe add labels to the PR, and did clang-tidy find a bunch more like this? If so, could make another PR with many of the same kind of change

@CryoTheRenegade

Copy link
Copy Markdown
Author

Clang-Tidy found a bunch, but I feel that a lot of them are not 100% accurate so i'm slowly running through a list to see if anything pops out at me before bulk applying fixes that may not be needed.

@@ -2496,7 +2496,7 @@ void W3DModelDraw::handleClientTurretPositioning()
void W3DModelDraw::handleClientRecoil()
{
const W3DModelDrawModuleData* d = getW3DModelDrawModuleData();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While at it, also move this past the return.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Has open comment

@xezon xezon added Minor Severity: Minor < Major < Critical < Blocker Gen Relates to Generals ZH Relates to Zero Hour Fix Is fixing something, but is not user facing Stability Concerns stability of the runtime labels Sep 16, 2026
@xezon xezon added this to the Stability fixes milestone Sep 16, 2026
@xezon xezon changed the title fix(W3DDevice): Return from handleClientRecoil() when m_curState is null fix(w3dmodeldraw): Avoid null dereference in W3DModelDraw::handleClientRecoil() Sep 16, 2026
@xezon xezon changed the title fix(w3dmodeldraw): Avoid null dereference in W3DModelDraw::handleClientRecoil() fix(w3dmodeldraw): Prevent null dereference in W3DModelDraw::handleClientRecoil() Sep 16, 2026
@xezon xezon changed the title fix(w3dmodeldraw): Prevent null dereference in W3DModelDraw::handleClientRecoil() fix(modeldraw): Prevent null dereference in W3DModelDraw::handleClientRecoil() Sep 18, 2026
@coderabbitai
coderabbitai Bot requested review from bobtista and xezon September 18, 2026 18:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Fix Is fixing something, but is not user facing Gen Relates to Generals Minor Severity: Minor < Major < Critical < Blocker Stability Concerns stability of the runtime ZH Relates to Zero Hour

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants