From 480f29e96e05fa14bd84c52d55eec2e6d851666f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=92=D0=BB=D0=B0=D0=B4=D0=B8=D1=81=D0=BB=D0=B0=D0=B2=20?= =?UTF-8?q?=D0=A1=D1=83=D1=85=D0=BE=D0=B2?= <22411953+Vladislav4KZ@users.noreply.github.com> Date: Thu, 23 Apr 2026 18:24:03 +0000 Subject: [PATCH] engine: common: mod_studio: fix model traversal and crash in Mod_StudioComputeBounds Mod_StudioComputeBounds incorrectly assumed that all models across all body parts were laid out contiguously in memory. This caused out-of-bounds reads or reading garbage data when loading complex models, leading to crashes. --- engine/common/mod_studio.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/engine/common/mod_studio.c b/engine/common/mod_studio.c index f1b24071..303941a1 100644 --- a/engine/common/mod_studio.c +++ b/engine/common/mod_studio.c @@ -690,7 +690,6 @@ static void Mod_StudioComputeBounds( void *buffer, vec3_t mins, vec3_t maxs, qbo vec3_t bone_mins, bone_maxs; vec3_t vert_mins, vert_maxs; int vert_count, bone_count; - int bodyCount = 0; vec3_t pos, *pverts; vert_count = bone_count = 0; @@ -706,18 +705,16 @@ static void Mod_StudioComputeBounds( void *buffer, vec3_t mins, vec3_t maxs, qbo // each body part has nummodels variations so there are as many total variations as there // are in a matrix of each part by each other part for( i = 0; i < pstudiohdr->numbodyparts; i++ ) - bodyCount += pbodypart[i].nummodels; - - // The studio models we want are vec3_t mins, vec3_t maxsight after the bodyparts (still need to - // find a detailed breakdown of the mdl format). Move pointer there. - m_pSubModel = (mstudiomodel_t *)(&pbodypart[pstudiohdr->numbodyparts]); - - for( i = 0; i < bodyCount; i++ ) { - pverts = (vec3_t *)((byte *)pstudiohdr + m_pSubModel[i].vertindex); + m_pSubModel = (mstudiomodel_t *)((byte *)pstudiohdr + pbodypart[i].modelindex); - for( j = 0; j < m_pSubModel[i].numverts; j++ ) - Mod_StudioBoundVertex( bone_mins, bone_maxs, &vert_count, pverts[j] ); + for( j = 0; j < pbodypart[i].nummodels; j++ ) + { + pverts = (vec3_t *)((byte *)pstudiohdr + m_pSubModel[j].vertindex); + + for( k = 0; k < m_pSubModel[j].numverts; k++ ) + Mod_StudioBoundVertex( bone_mins, bone_maxs, &vert_count, pverts[k] ); + } } pbones = (mstudiobone_t *)((byte *)pstudiohdr + pstudiohdr->boneindex);