dhewm/dhewm3
0
0
Fork 0
mirror of https://github.com/dhewm/dhewm3.git synced 2025-02-20 19:12:11 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix heap corruption when loading (broken?) .ma models

Browse source 
On FreeBSD, the game used to crash when loading the last level of RoE
(d3xp), while loading models/david/hell_h7.ma.
The problem could be reproduced on Linux whith #define USE_LIBC_MALLOC 1
and clang's AddressSanitizer.
Turns out that this file specifies a vertex transform for a non-existent
vertex (index 31, while we only have 0-30) and thus the bounds of
pMesh->vertexes[] are violated.
I added a check to ensure the index is within the bounds and a Warning
if it isn't.
It should work now. If however it turns out that more files have this
problem, maybe .ma is parsed incorrectly and we need a differently fix.

(Should) fix #138
This commit is contained in:
Daniel Gibson 2015-12-17 18:07:35 +01:00
parent df90fce6a5
commit 9950a5721f
1 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
neo/renderer/Model_ma.cpp
View file

@ -203,7 +203,7 @@ bool MA_ParseVertex(idParser& parser, maAttribHeader_t* header) {
//Allocate enough space for all the verts if this is the first attribute for verticies
if(!pMesh->vertexes) {
pMesh->numVertexes = header->size;
pMesh->numVertexes = header->size; // XXX: +1?
pMesh->vertexes = (idVec3 *)Mem_Alloc( sizeof( idVec3 ) * pMesh->numVertexes );
}
@ -692,7 +692,16 @@ void MA_ParseMesh(idParser& parser) {
//Now apply the pt transformations
for(int i = 0; i < pMesh->numVertTransforms; i++) {
pMesh->vertexes[(int)pMesh->vertTransforms[i].w] += pMesh->vertTransforms[i].ToVec3();
int idx = (int)pMesh->vertTransforms[i].w;
if(idx < 0 || idx >= pMesh->numVertexes)
{
// this happens with d3xp/models/david/hell_h7.ma in the d3xp hell level
// TODO: if it happens for other models, too, maybe it's intended and the .ma parsing is broken
common->Warning( "Model %s tried to set an out-of-bounds vertex transform (%d, but max vert. index is %d)!",
parser.GetFileName(), idx, pMesh->numVertexes-1 );
continue;
}
pMesh->vertexes[idx] += pMesh->vertTransforms[i].ToVec3();
}
MA_VERBOSE((va("MESH %s - parent %s\n", header.name, header.parent)));