From 973cd426224bc21dd321e105dbbcd971739b6e3e Mon Sep 17 00:00:00 2001 From: "Matias N. Goldberg" Date: Sun, 13 Jun 2021 21:31:02 -0300 Subject: [PATCH] Fix heap overflow when reading PF_RGB is 3 bytes. But later on Ogre2SelectionBuffer::OnSelectionClick will try to read 4 bytes from it. Fixed by ensuring it's always at least 4 bytes and zero-initializing those 4 bytes. Signed-off-by: Matias N. Goldberg --- ogre2/src/Ogre2SelectionBuffer.cc | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ogre2/src/Ogre2SelectionBuffer.cc b/ogre2/src/Ogre2SelectionBuffer.cc index 9221706d7..0354dd437 100644 --- a/ogre2/src/Ogre2SelectionBuffer.cc +++ b/ogre2/src/Ogre2SelectionBuffer.cc @@ -192,9 +192,12 @@ void Ogre2SelectionBuffer::CreateRTTBuffer() const_cast(scenePass)->mVisibilityMask = IGN_VISIBILITY_SELECTABLE; - // buffer to store render texture data - size_t bufferSize = Ogre::PixelUtil::getMemorySize(width, height, 1, format); + // buffer to store render texture data. Ensure it's at least 4 bytes + size_t bufferSize = std::min( + Ogre::PixelUtil::getMemorySize(width, height, 1, format), + 4u); this->dataPtr->buffer = new uint8_t[bufferSize]; + memset(this->dataPtr->buffer, 0, 4u); this->dataPtr->pixelBox = new Ogre::PixelBox(width, height, 1, format, this->dataPtr->buffer); }