Unidentified Server's Crash (Shutdown)

[Mitch]

The rate limit patch is not related to crashes. It is for preventing people from generating too much traffic on your server.

I never found why the server crashes when you are seeing a few cmdCount > MAX_PACKET_USERCMDS in your log.
How often does this crash happen and are you able to replicate the crash? Replicating the crash will make it easier to test and fix the issue.

I don't think cmdCount > MAX_PACKET_USERCMDS (32) is the cause of the crash.
https://github.com/id-Software/Quake...er/sv_client.c

#0 0x080e983d traces back to:

		int __cdecl sub_80E97F0(int a1, int a2)
{
  int v3; // [sp+Ch] [bp-Ch]@5
  char v4; // [sp+17h] [bp-1h]@1

  v4 = 1;
  if ( !(unsigned __int8)sub_80E9758(a2) )
    v4 = 0;
  if ( !(unsigned __int8)sub_80D9E84(a1 + 1348, a2) )
    v4 = 0;
  v3 = sub_80E9270(a2); // weapon = getweapon(index)
  if ( !*(_DWORD *)(v3 + 132) // = 0x080e983d = weapon offhandClass
    && *(_BYTE *)(a1 + 1365) != a2
    && *(_BYTE *)(a1 + 1366) != a2
    && *(_DWORD *)(v3 + 876) != a2 )
    v4 = 0;
  return (unsigned __int8)v4;
} 
	

		v7 = &v8[28 * i];
sub_8068ADE(a2, v11, v6, &v8[28 * i]);
if ( !(unsigned __int8)sub_80E97F0(v5, (unsigned __int8)v7[8]) ) // probably player entity, weapon index 
	

It could that for some reason the weapon index is out of range.
One way to found out is to hook the sub_80E9270 call and print a message when the index is invalid.

[Whiskas]

How often does this crash happen and are you able to replicate the crash? Replicating the crash will make it easier to test and fix the issue.

Could be 10 crashes per day. Usually one by one, then peace for next ~14 hours. I didn't tried to replicate it .

#0 0x080e983d traces back to:

		int __cdecl sub_80E97F0(int a1, int a2)
{
  int v3; // [sp+Ch] [bp-Ch]@5
  char v4; // [sp+17h] [bp-1h]@1

  v4 = 1;
  if ( !(unsigned __int8)sub_80E9758(a2) )
    v4 = 0;
  if ( !(unsigned __int8)sub_80D9E84(a1 + 1348, a2) )
    v4 = 0;
  v3 = sub_80E9270(a2); // weapon = getweapon(index)
  if ( !*(_DWORD *)(v3 + 132) // = 0x080e983d = weapon offhandClass
    && *(_BYTE *)(a1 + 1365) != a2
    && *(_BYTE *)(a1 + 1366) != a2
    && *(_DWORD *)(v3 + 876) != a2 )
    v4 = 0;
  return (unsigned __int8)v4;
} 
	

		v7 = &v8[28 * i];
sub_8068ADE(a2, v11, v6, &v8[28 * i]);
if ( !(unsigned __int8)sub_80E97F0(v5, (unsigned __int8)v7[8]) ) // probably player entity, weapon index 
	

Yeah, Kung foo man suggested to hook up the address into libcod:

		#if COD_VERSION == COD2_1_0
            if (0)
                cracking_hook_function(0x08092D5C, (int)SV_AddServerCommand);
            if (0)
                cracking_hook_function(0x0809301C, (int)SV_SendServerCommand);

            cracking_hook_call(0x0808F134, (int)hook_ClientUserinfoChanged);
            cracking_hook_call(0x0807059F, (int)Scr_GetCustomFunction);
            cracking_hook_call(0x080707C3, (int)Scr_GetCustomMethod);
            cracking_hook_call(0x08098CD0, (int)custom_SV_WriteDownloadToClient);
            cracking_hook_call(0x080DFF66, (int)hook_player_setmovespeed);
            cracking_hook_call(0x080F50AB, (int)hook_player_g_speed);
            cracking_hook_call(0x080E9524, (int)hook_findWeaponIndex);
            cracking_hook_call(0x080E983D, (int)hook_findProblem); // This address 
	

and add printf with parameters in gsc_player.cpp

		int hook_findProblem(int a1, int a2) { 
    printf("findProblem: %d %d\n", a1, a2);
    return 1; 
} 
	

Also added function to gsc_player.hpp

		int hook_findProblem(int a1, int a2); 
	

We hoped that it fill print arguments before server crash. But at the next ~10 segfaults there was no output from this address. So I've started to check out previous addresses and as I found addresses with MAX_PACKET kung suggested to check out previous threads on the forum.

It could that for some reason the weapon index is out of range.
One way to found out is to hook the sub_80E9270 call and print a message when the index is invalid.

Will do this, but yesterday I've implemented your libcod version, parsed cl_maxpackets on PlayersConnects and moved SearchForBan(); at the end of the Callback_PlayerConnect(). For now I didn't have any segfaults which is record for my server. If segmentation fault will came back I let you know with provided printf of sub_80E9270. Thanks for your time!

Whisky