-
-
Notifications
You must be signed in to change notification settings - Fork 21.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix memory corruption and assert failures in convex decomposition #85631
Fix memory corruption and assert failures in convex decomposition #85631
Conversation
This PR fixes how triangular faces are decomposed into vertices and indices. The pre-increment resulted in the indices table skipping entry 0 and potentially overrunning the end of the vertices vector.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Makes sense to me, would like the original author to weigh in if there was a reason for this. This is not something people tent to do by accident, most likely there was other code here before that makes this make sense..
It looks to have been introduced with 2ca94e5 and no code before it seems to implement the vertex-deduplication map trick. The older code uses duplicated vertices, but the loop doesn't seem to suffer from N+1 overruns. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good spot, must have missed this when we looked at #50404 .
Pouley is probably unlikely to reply as he's moved on to other work, but this was implementing something I suggested about removing unnecessary conversion between longhand vertex format (with duplicated verts) and vertex + index format, if I remember right. Nothing super complex going on here. |
Thanks! |
Cherry-picked for 4.2.1. |
@yythlj Please open an issue with more details about your case. |
Cherry-picked for 4.1.4. |
This PR fixes issue 85439 by changing the index pre-increment to post-increment so index 0 is not skipped and preventing a potential overrun past the end of the vertices vector.
Testing involved constructing a GLB file consisting of a single triangle:
Before this change the code allocates vertices and indices arrays of size 3 and writes the following:
After this change the code writes the following:
The collision shape with this new data appears correct:
offset_triangle.zip