Skip to content

Fix Heap buffer overflow in Animation::_find() #106654

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 21, 2025
Merged

Fix Heap buffer overflow in Animation::_find() #106654

merged 1 commit into from
May 21, 2025
+1 −1

Conversation

jamie-pate
Copy link
Contributor

Fixes #106647

middle can be set to -1 and then used as an index in keys, which causes a heap buffer underflow.

@jamie-pate jamie-pate requested a review from a team as a code owner May 20, 2025 22:27
clayjohn
clayjohn reviewed May 20, 2025
View reviewed changes
TokageItLab
TokageItLab approved these changes May 21, 2025
View reviewed changes
Copy link
Member

@TokageItLab TokageItLab left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, this was my fault. Thanks for the follow up!

@TokageItLab TokageItLab added this to the 4.5 milestone May 21, 2025
@TokageItLab TokageItLab added bug crash topic:animation cherrypick:4.4 Considered for cherry-picking into a future 4.4.x release cherrypick:4.3 Considered for cherry-picking into a future 4.3.x release labels May 21, 2025
@Repiteo Repiteo merged commit 4a44078 into godotengine:master May 21, 2025
20 checks passed
@Repiteo
Copy link
Contributor

Repiteo commented May 21, 2025

Thanks!

@TokageItLab TokageItLab mentioned this pull request May 21, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@a-johnston a-johnston a-johnston left review comments

@clayjohn clayjohn clayjohn left review comments

@TokageItLab TokageItLab TokageItLab approved these changes

Assignees
No one assigned
Labels
bug cherrypick:4.3 Considered for cherry-picking into a future 4.3.x release cherrypick:4.4 Considered for cherry-picking into a future 4.4.x release crash topic:animation
Projects
None yet
Milestone
4.5
Development

Successfully merging this pull request may close these issues.

Heap buffer overflow in Animation::_find()
5 participants
@jamie-pate @Repiteo @a-johnston @clayjohn @TokageItLab