Hello everyone,
We are releasing a small patch today with some security fixes. Servers and clients are recommended to update as soon as possible.
The changelog is as follows:
- Made Entity.PhysicsInitMultiConvex throw type errors when given invalid input
- Removed unused DLLs from game's folder - bugreporter.dll, sixense.dll, headtrack_oculus.dll
- Shutdown HTML after VGUI - hopefully fixes a rare crash on game exit
- Made the BSP whitelist case insensitive
- Blocked access to .db files via the file library
- Made GM:OnLuaError available on client and server
- Made LuaMesh.BuildFromTriangles correctly modify the mesh when used on an already generated mesh - This is now only permitted when the vertex count matches between existing mesh, and the new mesh.
- Added safeguards against malformed .gma files
- Added overflow/underflow safeguards to render.Push/PopRenderTarget functions
- Fixed several security issues reported on HackerOne
January 22 Update:
- Fixed crash with npc_satchel
- Fixed crash when try to push a NULL ITexture
- Fixed a crash when failing to create a fish entity
- Fixed a crash when failing to create child ents for point_spotlight
- Fixed crashes when failing to create entities for fire entity
- Fixed Gravity Gun leaking material reference count
- Fixed crashes with deleting ai_network entity
- Bumped "insane reference count" threshold 10x
January 23 Update:
- Fixed crashes with NPC nodes after cleaning up the map