RomkaZVO/xash3d-fwgs
1
0
Fork 0
mirror of https://github.com/FWGS/xash3d-fwgs.git synced 2026-08-05 03:24:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

engine: common: mod_studio: fix model traversal and crash in Mod_StudioComputeBounds

Browse Source 
Mod_StudioComputeBounds incorrectly assumed that all models across all body parts were laid out contiguously in memory. This caused out-of-bounds reads or reading garbage data when loading complex models, leading to crashes.
This commit is contained in:
Владислав Сухов
2026-04-23 18:24:03 +00:00
committed by a1batross
parent 95548053eb
commit 480f29e96e
1 changed files with 8 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
engine/common/mod_studio.c
View File

@@ -690,7 +690,6 @@ static void Mod_StudioComputeBounds( void *buffer, vec3_t mins, vec3_t maxs, qbo
vec3_t bone_mins, bone_maxs; vec3_t bone_mins, bone_maxs;
vec3_t vert_mins, vert_maxs; vec3_t vert_mins, vert_maxs;
int vert_count, bone_count; int vert_count, bone_count;
int bodyCount = 0;
vec3_t pos, *pverts; vec3_t pos, *pverts;
vert_count = bone_count = 0; vert_count = bone_count = 0;
@@ -706,18 +705,16 @@ static void Mod_StudioComputeBounds( void *buffer, vec3_t mins, vec3_t maxs, qbo
// each body part has nummodels variations so there are as many total variations as there // each body part has nummodels variations so there are as many total variations as there
// are in a matrix of each part by each other part // are in a matrix of each part by each other part
for( i = 0; i < pstudiohdr->numbodyparts; i++ ) for( i = 0; i < pstudiohdr->numbodyparts; i++ )
bodyCount += pbodypart[i].nummodels;
// The studio models we want are vec3_t mins, vec3_t maxsight after the bodyparts (still need to
// find a detailed breakdown of the mdl format). Move pointer there.
m_pSubModel = (mstudiomodel_t *)(&pbodypart[pstudiohdr->numbodyparts]);
for( i = 0; i < bodyCount; i++ )
{ {
pverts = (vec3_t *)((byte *)pstudiohdr + m_pSubModel[i].vertindex); m_pSubModel = (mstudiomodel_t *)((byte *)pstudiohdr + pbodypart[i].modelindex);
for( j = 0; j < m_pSubModel[i].numverts; j++ ) for( j = 0; j < pbodypart[i].nummodels; j++ )
Mod_StudioBoundVertex( bone_mins, bone_maxs, &vert_count, pverts[j] ); {
pverts = (vec3_t *)((byte *)pstudiohdr + m_pSubModel[j].vertindex);
for( k = 0; k < m_pSubModel[j].numverts; k++ )
Mod_StudioBoundVertex( bone_mins, bone_maxs, &vert_count, pverts[k] );
}
} }
pbones = (mstudiobone_t *)((byte *)pstudiohdr + pstudiohdr->boneindex); pbones = (mstudiobone_t *)((byte *)pstudiohdr + pstudiohdr->boneindex);