Fix Heap buffer overflow in Animation::_find() #106654
Open
+1
−1
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
clayjohn
reviewed
May 20, 2025
scene/resources/animation.cpp
Outdated
| @@ -2441,7 +2441,7 @@ int Animation::_find(const Vector<K> &p_keys, double p_time, bool p_backward, bo | |||
| } | |||
| } | |||
|
|
|||
| if (p_limit) { | |||
| if (p_limit && middle > -1) { | |||
There was a problem hiding this comment.
Do we still want the error if middle is -1?
There was a problem hiding this comment.
The error says 'found the key' but if middle is -1 then we didn't find the key (binary search has gone off the left side of the array)
There was a problem hiding this comment.
The error is specifically for if a valid key is found but it's outside the animation's range; from the usage of this method both -1 and len are valid return values. With that in mind this check should cover both bounds - p_limit && middle > -1 && middle < len.
There was a problem hiding this comment.
Thanks for the answers!
That makes sense. And also makes sense why we would want to also check that middle < len
TokageItLab
approved these changes
May 21, 2025
TokageItLab
added
bug
crash
topic:animation
cherrypick:4.4
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #106647
middlecan be set to -1 and then used as an index inkeys, which causes a heap buffer underflow.