oh ok...
the CBaseStuff is always located behind the edict_s pvPrivateData pointer, right ?
Code:
struct edict_s
{
qboolean free;
int serialnumber;
link_t area; // linked to a division node or leaf
int headnode; // -1 to use normal leaf check
int num_leafs;
short leafnums[MAX_ENT_LEAFS];
float freetime; // sv.time when the object was freed
void* pvPrivateData; // Alloced and freed by engine, used by DLLs
entvars_t v; // C exported fields from progs
// other fields from progs come immediately after
};
well wouldn't it be possible that you do it yourself (i.e malloc() some space behind this pointer and zero it out), not forgetting to free it when you set the FL_KILLME flag ?
That would be wasted space, but could probably prevent it to crash.
If you know the address of the entvars struct for that entity, you can safely deduce the address of its pvPrivateData pointer too ( -4 ). I'd investigate there...