Skip to content

Fix LevelUniforms buffer overflow - #346

Open
djefrey wants to merge 1 commit into
Engine-Room:1.21.1/devfrom
djefrey:1.21.1/fix-buffer-overflow
Open

djefrey wants to merge 1 commit into
Engine-Room:1.21.1/devfrom
djefrey:1.21.1/fix-buffer-overflow

Conversation

@djefrey

@djefrey djefrey commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

LevelUniforms allocates 112 bytes, but 116 bytes are written. This results in a buffer overflow of 4 bytes.
According to this AI report (djefrey/Colorwheel#88), the same bug in Colorwheel results in issues with Voxy.

FrameUniforms.SIZE is also incorrect, but the align16 in UniformBuffer results in a large enough malloc.

Uniform buffers were tested by adding this code at the end of each update implementation

var usedBytes = ptr - BUFFER.ptr();
var allocBytes = MoreMath.align16(SIZE);
if (usedBytes > allocBytes)
{
    FlwBackend.LOGGER.error("Buffer overflow: {} / {}", usedBytes, allocBytes);
}
else if (usedBytes > SIZE)
{
    FlwBackend.LOGGER.error("Invalid size: {} / {}", usedBytes, SIZE);
}

LevelUniforms SIZE was one scalar short, causing a buffer overflow
FrameUniforms SIZE was two scalar shorts, but align16 prevented the overflow

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant