Skip to content

Commit

Permalink
#1176 Fix out of bounds memory write when bulk overriding components
Browse files Browse the repository at this point in the history
without this fix, the newly introduced test case would segfault. This bug happens due to the fact that in C you loop count times, but also offset the dest_ptr, and then within the copy impl of C++, it loops count again, this means you would go count-1 * size_obj out of memory bounds for src as well as dest ptr.

This fix is the correct fix as it limits src ptr to just 1, while the dest ptr still gets offset each iteration.

(this was previously discussed with sanders, the information above is just for tracking why & what)
  • Loading branch information
Indra-db authored and SanderMertens committed Mar 22, 2024
1 parent 87f9ae6 commit 0eafe0c
Show file tree
Hide file tree
Showing 5 changed files with 99 additions and 44 deletions.
2 changes: 1 addition & 1 deletion flecs.c
Original file line number Diff line number Diff line change
Expand Up @@ -15148,7 +15148,7 @@ void flecs_override_copy(
int32_t i;
if (copy) {
for (i = 0; i < count; i ++) {
copy(ptr, src, count, ti);
copy(ptr, src, 1, ti);
ptr = ECS_OFFSET(ptr, size);
}
} else {
Expand Down
2 changes: 1 addition & 1 deletion src/observable.c
Original file line number Diff line number Diff line change
Expand Up @@ -500,7 +500,7 @@ void flecs_override_copy(
int32_t i;
if (copy) {
for (i = 0; i < count; i ++) {
copy(ptr, src, count, ti);
copy(ptr, src, 1, ti);
ptr = ECS_OFFSET(ptr, size);
}
} else {
Expand Down
3 changes: 2 additions & 1 deletion test/api/project.json
Original file line number Diff line number Diff line change
Expand Up @@ -1068,7 +1068,8 @@
"on_set_hook_on_override",
"on_set_hook_on_auto_override",
"batched_set_new_component_w_lifecycle",
"batched_ensure_new_component_w_lifecycle"
"batched_ensure_new_component_w_lifecycle",
"on_nested_prefab_copy_test_invokes_copy_count"
]
}, {
"id": "Sorting",
Expand Down
Loading

0 comments on commit 0eafe0c

Please sign in to comment.