Skip to content

Added size limit check for buffer stride - #567

Merged
stefanatwork merged 8 commits into
masterfrom
sw/stride_check
Nov 24, 2025
Merged

stefanatwork merged 8 commits into
masterfrom
sw/stride_check

Conversation

@stefanatwork

Copy link
Copy Markdown
Collaborator

Preventing possible wrap to zero when itemCount * bufferStride exceed 64 bit uint limit.

@stefanatwork stefanatwork self-assigned this Oct 30, 2025
@stefanatwork stefanatwork added this to the v4.4.1 milestone Oct 30, 2025
@svenwoop

Copy link
Copy Markdown
Collaborator

This does still not do the entire job. There is some "buffer range out of bounds" check in buffer.h line 251. First that check is wrong IMHO, as it should test to buffer_in->numBytes only on the right hand side and not multiply by stride_in.
Second even if fixed, the calculation offset_in+stride_in*num_in can still overflow if a large offset_in is used.

@svenwoop

Copy link
Copy Markdown
Collaborator

That check in buffer.h should better be placed inside rtcore.cpp actually, thus all valid checks are at main API wrapper file.

@svenwoop

Copy link
Copy Markdown
Collaborator

The check offset + Nstride >= buffer_size can be written as Nstride >= buffer_size - offset. Also check first if offset <= buffer_size.

@stefanatwork

Copy link
Copy Markdown
Collaborator Author

@svenwoop can you take another look?

Comment thread kernels/common/buffer.h Outdated
Comment thread kernels/common/buffer.h Outdated
Comment thread kernels/common/scene_grid_mesh.h
Comment thread kernels/common/scene_grid_mesh.h Outdated
@stefanatwork
stefanatwork merged commit 515904d into master Nov 24, 2025
4 checks passed
@stefanatwork
stefanatwork deleted the sw/stride_check branch November 24, 2025 11:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants