mirror of
https://bitbucket.org/CPMADevs/cnq3
synced 2025-02-23 04:11:22 +00:00
also increased the buffer's size (e.g. to draw all chars in the console in 4K) one of the crashes happens in R_SortDrawSurfs: -> render command list is too full -> RE_EndFrame returns early because it can't allocate RC_SWAP_BUFFERS -> R_ClearFrame in RE_EndFrame doesn't get called -> the next frame starts with r_firstSceneDrawSurf etc. not being reset to 0 -> r_firstSceneDrawSurf becomes really close to the maximum draw surface limit -> the draw surface list is iterated incorrectly (no wrapping handled) -> we fetch a draw surface we shouldn't -> its sort key gets decoded and we get an invalid sorted shader index -> we fetch a NULL shader at that index location -> we attempt to read shader->sort -> we crash reading address 76 -> 76 bytes is exactly the offset of the sort member into the shader_t struct |
||
---|---|---|
.. | ||
botlib | ||
client | ||
glew | ||
libjpeg-turbo | ||
libunwind | ||
linux | ||
null | ||
qcommon | ||
renderer | ||
server | ||
tools | ||
win32 |