Skip to content

Commit 3f29ea4

Browse files
committed
Fix AddressSanitizer: heap-buffer-overflow caused by incorrect padding
Fixes godotengine#94548 Use reserve() instead of resize() when padding the buffer passed to embree, otherwise it will look past the end of the buffer since we pass the size() to rtcSetSharedGeometryBuffer and it dereferences `(int*)getPtr(size()-1) + 3` could cause a segfault if `capacity < size + 12`(bytes) When the address sanitizer is enabled it triggers an assertion /*! checks padding to 16 byte check, fails hard */ __forceinline void checkPadding16() const { if (ptr_ofs && num) volatile int MAYBE_UNUSED w = *((int*)getPtr(size()-1)+3); // FIXME: is failing hard avoidable? }
1 parent a0943ac commit 3f29ea4

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

modules/raycast/raycast_occlusion_cull.cpp

+4-2
Original file line numberDiff line numberDiff line change
@@ -349,9 +349,11 @@ void RaycastOcclusionCull::Scenario::_update_dirty_instance(int p_idx, RID *p_in
349349
}
350350

351351
int vertices_size = occ->vertices.size();
352-
352+
occ_inst->xformed_vertices.resize(vertices_size);
353353
// Embree requires the last element to be readable by a 16-byte SSE load instruction, so we add padding to be safe.
354-
occ_inst->xformed_vertices.resize(vertices_size + 1);
354+
const size_t byte_padding = sizeof(int) * 3;
355+
const size_t vertices_padding = ceil((float)byte_padding / (float)sizeof(Vector3));
356+
occ_inst->xformed_vertices.reserve(vertices_size + vertices_padding);
355357

356358
const Vector3 *read_ptr = occ->vertices.ptr();
357359
Vector3 *write_ptr = occ_inst->xformed_vertices.ptr();

0 commit comments

Comments
 (0)