Commit Graph

2 Commits

Author SHA1 Message Date
Jan Engelhardt
201b88c9aa Resolve out-of-bounds access in AIDoMemFrame
As level 1's in-engine cutscene runs, an OOB happens after about 3s.

x=0 object[x].type=4
x=1 object[x].type=18
x=2 object[x].type=255
$GIT/physics/findintersection.cpp:2196:80: runtime error: index 255 out of bounds for type 'unsigned char [26]'
$GIT/physics/findintersection.cpp:2196:80: runtime error: load of address 0x00000475a97f with insufficient space for an object of type 'uint8_t'
==28871==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000475a97f at pc 0x000001242275 bp 0x7fffc1ced720 sp 0x7fffc1ced718
READ of size 1 at 0x00000475a97f thread T0
    f0 fvi_QuickDistObjectList(vector*, int, float, short*, int, bool, bool, bool, bool) $GIT/physics/findintersection.cpp:2196
    f1 AIDoMemFrame $GIT/Descent3/AImain.cpp:6066
    f2 AIDoFrame(object*) $GIT/Descent3/AImain.cpp:6187
    f3 ObjDoFrame(object*) $GIT/Descent3/object.cpp:2674
    f4 ObjDoFrameAll() $GIT/Descent3/object.cpp:2988
    f5 GameFrame() $GIT/Descent3/GameLoop.cpp:2980
    f6 GameSequencer() $GIT/Descent3/gamesequence.cpp:1221
    f7 PlayGame() $GIT/Descent3/game.cpp:834
    f8 MainLoop() $GIT/Descent3/descent.cpp:555
    f9 Descent3() $GIT/Descent3/descent.cpp:508
    f10 oeD3LnxApp::run() $GIT/Descent3/sdlmain.cpp:151

0x00000475a97f is located 30 bytes after global variable 'FVI_always_check_ceiling' defined in '$GIT/physics/findintersection.cpp:888:6' (0x475a960) of size 1
  'FVI_always_check_ceiling' is ascii string ''
0x00000475a97f is located 33 bytes before global variable 'fvi_visit_list' defined in '$GIT/physics/findintersection.cpp:895:5' (0x475a9a0) of size 51
2024-08-30 02:37:15 +02:00
Azamat H. Hackimov
b9da6b59ff Isolate physics module
Update physics module, minor cleanups, remove unused code.
2024-07-28 16:50:42 +03:00