Commit Graph

6 Commits

Author SHA1 Message Date
Jan Engelhardt
96c787bfb2 Fix spello "interative why" 2024-09-03 13:26:51 +02:00
Jan Engelhardt
b14470bbff Fix spello "independan.." 2024-09-03 13:26:51 +02:00
Louis Gombert
dd6e684712 Merge pull request #555 from jengelh/collide
Resolve out-of-bounds in PolyCollideObject [ASAN]
2024-09-02 21:03:32 +02:00
Jan Engelhardt
cb5c2913b2 Resolve out-of-bounds access in fvi_room
Possibly fixes #530.

physics/findintersection.cpp:4711:64: runtime error: index -1 out of bounds for type 'fvi_face_room_list [200]'
=================================================================
SIGNAL 11 caught, aborting
2024-08-31 11:21:09 +02:00
Jan Engelhardt
201b88c9aa Resolve out-of-bounds access in AIDoMemFrame
As level 1's in-engine cutscene runs, an OOB happens after about 3s.

x=0 object[x].type=4
x=1 object[x].type=18
x=2 object[x].type=255
$GIT/physics/findintersection.cpp:2196:80: runtime error: index 255 out of bounds for type 'unsigned char [26]'
$GIT/physics/findintersection.cpp:2196:80: runtime error: load of address 0x00000475a97f with insufficient space for an object of type 'uint8_t'
==28871==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000475a97f at pc 0x000001242275 bp 0x7fffc1ced720 sp 0x7fffc1ced718
READ of size 1 at 0x00000475a97f thread T0
    f0 fvi_QuickDistObjectList(vector*, int, float, short*, int, bool, bool, bool, bool) $GIT/physics/findintersection.cpp:2196
    f1 AIDoMemFrame $GIT/Descent3/AImain.cpp:6066
    f2 AIDoFrame(object*) $GIT/Descent3/AImain.cpp:6187
    f3 ObjDoFrame(object*) $GIT/Descent3/object.cpp:2674
    f4 ObjDoFrameAll() $GIT/Descent3/object.cpp:2988
    f5 GameFrame() $GIT/Descent3/GameLoop.cpp:2980
    f6 GameSequencer() $GIT/Descent3/gamesequence.cpp:1221
    f7 PlayGame() $GIT/Descent3/game.cpp:834
    f8 MainLoop() $GIT/Descent3/descent.cpp:555
    f9 Descent3() $GIT/Descent3/descent.cpp:508
    f10 oeD3LnxApp::run() $GIT/Descent3/sdlmain.cpp:151

0x00000475a97f is located 30 bytes after global variable 'FVI_always_check_ceiling' defined in '$GIT/physics/findintersection.cpp:888:6' (0x475a960) of size 1
  'FVI_always_check_ceiling' is ascii string ''
0x00000475a97f is located 33 bytes before global variable 'fvi_visit_list' defined in '$GIT/physics/findintersection.cpp:895:5' (0x475a9a0) of size 51
2024-08-30 02:37:15 +02:00
Azamat H. Hackimov
b9da6b59ff Isolate physics module
Update physics module, minor cleanups, remove unused code.
2024-07-28 16:50:42 +03:00