jump.tf Forums
Welcome B)

Exploitable map bug with info_player_teamspawn

AI · 1 · 13123

AI

  • Administrator
  • Proficient
  • *****
    • Posts: 419
    • Frags: +0/-0
  • Plugins Developer
    • View Profile
    • Jump Academy
While debugging what I first thought was a jumpbot compatibility issue with the map jump_vanilla where players turn into civilian after being respawned following a recording playback, with GentlePuppet's help we narrowed it down to a misplaced info_player_teamspawn entity.

Even though players are able to spawn into the map fine both offline and on servers, there is actually a brief moment when the player becomes civilian before the regen trigger kicks in and restores the player's weapon loadout.  However, one of the jumps ("17") was missing a regen trigger, so players who get instantly teleported to this jump after spawning (including teleporting from location saves) will also become civilian.  This is apparently a known issue on the TF2Maps forums and is caused by the info_player_teamspawn entity being too close to the ground.  Thus, the fix is just to keep this entity 1-2 Hammer units off the ground just to be safe.

For jump maps, since they are usually covered by regen triggers anyway, at first, this seems like a harmless glitch that goes away after a second. However, it turns out this can be exploited to crash servers.  Each time a player spawns and turns civilian this way, their weapons entities are not destroyed, and new ones are created when the regen triggers kicks in to re-equip the loadout.  This means each spawn creates about 4-6 fresh new entities, and with most jump servers having instant respawn, repeatedly spamming class changes will eventually cause the server to hit the the edict limit and crash.

Having one player change through each class just once was enough to spawn 43 weapon entities within 10 seconds:



Rinse and repeat with more time and multiple players, and the server will crash, even if done unintentionally.

Therefore, server operators should watch out for this and patch the maps with Stripper, and mappers should be careful with this entity while mapping.