From f3a6e04f8b83cce1b7789d726e8e90950b86ca06 Mon Sep 17 00:00:00 2001 From: smix8 <52464204+smix8@users.noreply.github.com> Date: Mon, 19 Jun 2023 20:10:39 +0200 Subject: [PATCH] Fix potential crashes in navmesh bake geometry functions Fixes potential crashes in navmesh geometry functions. --- modules/navigation/navigation_mesh_generator.cpp | 10 ++++++++++ .../navigation_mesh_source_geometry_data_3d.cpp | 10 ++++++++++ 2 files changed, 20 insertions(+) diff --git a/modules/navigation/navigation_mesh_generator.cpp b/modules/navigation/navigation_mesh_generator.cpp index 88965cd4395..18c82562559 100644 --- a/modules/navigation/navigation_mesh_generator.cpp +++ b/modules/navigation/navigation_mesh_generator.cpp @@ -92,12 +92,15 @@ void NavigationMeshGenerator::_add_mesh(const Ref &p_mesh, const Transform int face_count = index_count / 3; Array a = p_mesh->surface_get_arrays(i); + ERR_CONTINUE(a.is_empty() || (a.size() != Mesh::ARRAY_MAX)); Vector mesh_vertices = a[Mesh::ARRAY_VERTEX]; + ERR_CONTINUE(mesh_vertices.is_empty()); const Vector3 *vr = mesh_vertices.ptr(); if (p_mesh->surface_get_format(i) & Mesh::ARRAY_FORMAT_INDEX) { Vector mesh_indices = a[Mesh::ARRAY_INDEX]; + ERR_CONTINUE(mesh_indices.is_empty() || (mesh_indices.size() != index_count)); const int *ir = mesh_indices.ptr(); for (int j = 0; j < mesh_vertices.size(); j++) { @@ -111,6 +114,7 @@ void NavigationMeshGenerator::_add_mesh(const Ref &p_mesh, const Transform p_indices.push_back(current_vertex_count + (ir[j * 3 + 1])); } } else { + ERR_CONTINUE(mesh_vertices.size() != index_count); face_count = mesh_vertices.size() / 3; for (int j = 0; j < face_count; j++) { _add_vertex(p_xform.xform(vr[j * 3 + 0]), p_vertices); @@ -126,10 +130,14 @@ void NavigationMeshGenerator::_add_mesh(const Ref &p_mesh, const Transform } void NavigationMeshGenerator::_add_mesh_array(const Array &p_array, const Transform3D &p_xform, Vector &p_vertices, Vector &p_indices) { + ERR_FAIL_COND(p_array.size() != Mesh::ARRAY_MAX); + Vector mesh_vertices = p_array[Mesh::ARRAY_VERTEX]; + ERR_FAIL_COND(mesh_vertices.is_empty()); const Vector3 *vr = mesh_vertices.ptr(); Vector mesh_indices = p_array[Mesh::ARRAY_INDEX]; + ERR_FAIL_COND(mesh_indices.is_empty()); const int *ir = mesh_indices.ptr(); const int face_count = mesh_indices.size() / 3; @@ -148,6 +156,8 @@ void NavigationMeshGenerator::_add_mesh_array(const Array &p_array, const Transf } void NavigationMeshGenerator::_add_faces(const PackedVector3Array &p_faces, const Transform3D &p_xform, Vector &p_vertices, Vector &p_indices) { + ERR_FAIL_COND(p_faces.is_empty()); + ERR_FAIL_COND(p_faces.size() % 3 != 0); int face_count = p_faces.size() / 3; int current_vertex_count = p_vertices.size() / 3; diff --git a/scene/resources/navigation_mesh_source_geometry_data_3d.cpp b/scene/resources/navigation_mesh_source_geometry_data_3d.cpp index 0201fb70b21..412455be73e 100644 --- a/scene/resources/navigation_mesh_source_geometry_data_3d.cpp +++ b/scene/resources/navigation_mesh_source_geometry_data_3d.cpp @@ -70,12 +70,15 @@ void NavigationMeshSourceGeometryData3D::_add_mesh(const Ref &p_mesh, cons int face_count = index_count / 3; Array a = p_mesh->surface_get_arrays(i); + ERR_CONTINUE(a.is_empty() || (a.size() != Mesh::ARRAY_MAX)); Vector mesh_vertices = a[Mesh::ARRAY_VERTEX]; + ERR_CONTINUE(mesh_vertices.is_empty()); const Vector3 *vr = mesh_vertices.ptr(); if (p_mesh->surface_get_format(i) & Mesh::ARRAY_FORMAT_INDEX) { Vector mesh_indices = a[Mesh::ARRAY_INDEX]; + ERR_CONTINUE(mesh_indices.is_empty() || (mesh_indices.size() != index_count)); const int *ir = mesh_indices.ptr(); for (int j = 0; j < mesh_vertices.size(); j++) { @@ -89,6 +92,7 @@ void NavigationMeshSourceGeometryData3D::_add_mesh(const Ref &p_mesh, cons indices.push_back(current_vertex_count + (ir[j * 3 + 1])); } } else { + ERR_CONTINUE(mesh_vertices.size() != index_count); face_count = mesh_vertices.size() / 3; for (int j = 0; j < face_count; j++) { _add_vertex(p_xform.xform(vr[j * 3 + 0])); @@ -104,10 +108,14 @@ void NavigationMeshSourceGeometryData3D::_add_mesh(const Ref &p_mesh, cons } void NavigationMeshSourceGeometryData3D::_add_mesh_array(const Array &p_mesh_array, const Transform3D &p_xform) { + ERR_FAIL_COND(p_mesh_array.size() != Mesh::ARRAY_MAX); + Vector mesh_vertices = p_mesh_array[Mesh::ARRAY_VERTEX]; + ERR_FAIL_COND(mesh_vertices.is_empty()); const Vector3 *vr = mesh_vertices.ptr(); Vector mesh_indices = p_mesh_array[Mesh::ARRAY_INDEX]; + ERR_FAIL_COND(mesh_indices.is_empty()); const int *ir = mesh_indices.ptr(); const int face_count = mesh_indices.size() / 3; @@ -126,6 +134,8 @@ void NavigationMeshSourceGeometryData3D::_add_mesh_array(const Array &p_mesh_arr } void NavigationMeshSourceGeometryData3D::_add_faces(const PackedVector3Array &p_faces, const Transform3D &p_xform) { + ERR_FAIL_COND(p_faces.is_empty()); + ERR_FAIL_COND(p_faces.size() % 3 != 0); int face_count = p_faces.size() / 3; int current_vertex_count = vertices.size() / 3;