some new crash exploit? (ClipRayToVPhysics)

[kilorat]

I'd like to figure out how they're doing this to my server so I can stop it, but there's some new crash exploit going around.
I'm not sure how to really discuss this, since if anyone posts exactly how to do it, that will get used for evil.

The server crashes, core dumps, and if I run it through a debugger, and do a backtrace, it's always in ClipRayToVPhysics()

Someone else posted this on the hlds mailing list:

Code:

#0  0xf771310c in CEngineTrace::ClipRayToVPhysics ()
   from orangebox/bin/engine_i486.so
#1  0xf77148f3 in CEngineTrace::ClipRayToCollideable ()
   from orangebox/bin/engine_i486.so
#2  0xf7715005 in CEngineTrace::TraceRay ()
   from orangebox/bin/engine_i486.so
#3  0xf5b67c04 in CTFSniperRifle::UpdateSniperDot ()
   from orangebox/tf/bin/server_i486.so
#4  0xf5b6a8a2 in CTFSniperRifle::ItemPostFrame ()
   from orangebox/tf/bin/server_i486.so
#5  0xf55735ce in CBasePlayer::ItemPostFrame ()
   from orangebox/tf/bin/server_i486.so
#6  0xf5af971c in CTFPlayer::ItemPostFrame ()
   from orangebox/tf/bin/server_i486.so
#7  0xf57aeef8 in CBasePlayer::PostThink ()
   from orangebox/tf/bin/server_i486.so
#8  0xf5ae1dba in CTFPlayer::PostThink ()
   from orangebox/tf/bin/server_i486.so
#9  0xf57c6872 in CPlayerMove::RunPostThink ()
   from orangebox/tf/bin/server_i486.so
#10 0xf57c83ba in CPlayerMove::RunCommand ()
   from orangebox/tf/bin/server_i486.so

He says he's not using Sourcemod. But I am..
Here is from my server:

Code:

#0  0xf77ec10c in CEngineTrace::ClipRayToVPhysics ()
   from orangebox/bin/engine_i486.so
#1  0xf77ed8f3 in CEngineTrace::ClipRayToCollideable ()
   from orangebox/bin/engine_i486.so
#2  0xf77edf6f in CEngineTrace::TraceRay ()
   from orangebox/bin/engine_i486.so
#3  0xf0cb33bb in smn_TRTraceRayFilterEx ()
   from orangebox/tf/addons/sourcemod/extensions/auto.2.ep2/sdktools.ext.so
#4  0xf187ceca in NativeCallback ()
   from orangebox/tf/addons/sourcemod/bin/sourcepawn.jit.x86.so

or sometimes this varient (hopefully this isnt unrelated)

Code:

#0  0xf5caae06 in CTFProjectile_Arrow::PositionArrowOnBone ()
   from orangebox/tf/bin/server_i486.so
#1  0xf5cac3e2 in CTFProjectile_Arrow::StrikeTarget ()
   from orangebox/tf/bin/server_i486.so
#2  0xf5cabc0b in CTFProjectile_Arrow::ArrowTouch ()

I'm not asking for a fix, that's really Valve's job, but if I can figure out what is triggering it, maybe I can prevent it from happening, or at the very least, detect it so I know who to ban/firewall.

[cookies911]

Well, it's TF based, so i really can't help you

[realchamp]

Disable UDP flood and be sure to have a firewall etc.