fixed heap-use-after-free in solidgen

[csRadar.git] / vmf.h

diff --git a/vmf.h b/vmf.h
index ff3804d8c29691add5a67d82ba4f2eb64305f4e4..c3abc2a4026c9b5486cd4aec533d9e7829ea7941 100644 (file)
--- a/vmf.h
+++ b/vmf.h
@@ -280,34 +280,12 @@ ESolidResult solidgen_push( vmf_solid *ctx, vdf_node *node )
 {
        ESolidResult flag = k_ESolidResult_valid;
 
 {
        ESolidResult flag = k_ESolidResult_valid;
 

+       double planes[ SOLID_MAX_SIDES*4 ];

        vmf_face faces[ SOLID_MAX_SIDES ];
 
        vmf_face faces[ SOLID_MAX_SIDES ];
 

-       int is_displacement = 0;
+       int is_displacement = solid_has_displacement( node );

        int num_planes = 0;
        
        int num_planes = 0;
        

-       // TODO: What is this for again? surely it should be the other way around... i think...
-       if( solid_has_displacement( node ) )
-       {
-               is_displacement = 1;
-               /*
-       
-               printf( "solid_has_displacement\n" );
-               num_planes = vmf_api.bisectors;
-       
-               // Add dummy stuff for globals
-               // ???
-               for( int k = 0; k < vmf_api.bisectors; k ++ )
-               {
-                       vmf_face *dummy = faces + k;
-                       dummy->indices = NULL;
-                       dummy->dispinfo = NULL;
-                       dummy->material = NULL;
-               }
-               
-               is_displacement = 1;
-               */
-       }
-       

        int it = 0; 
        vdf_node *pSide;
        while( (pSide = vdf_next(node, "side", &it)) )
        int it = 0; 
        vdf_node *pSide;
        while( (pSide = vdf_next(node, "side", &it)) )


@@ -329,7 +307,7 @@ ESolidResult solidgen_push( vmf_solid *ctx, vdf_node *node )
                
                kv_double_array( pSide, "plane", 9, points );
                
                
                kv_double_array( pSide, "plane", 9, points );
                

-               tri_to_plane( points+6, points+3, points+0, vmf_api.planes + num_planes * 4 );
+               tri_to_plane( points+6, points+3, points+0, planes + num_planes * 4 );

                num_planes ++;
        }
        
                num_planes ++;
        }
        


@@ -349,14 +327,14 @@ ESolidResult solidgen_push( vmf_solid *ctx, vdf_node *node )
                if( (faces[ i[0] ].blacklisted && faces[ i[1] ].blacklisted && faces[ i[2] ].blacklisted) )
                        continue;
                        
                if( (faces[ i[0] ].blacklisted && faces[ i[1] ].blacklisted && faces[ i[2] ].blacklisted) )
                        continue;
                        

-               if( !plane_intersect( vmf_api.planes+i[0]*4, vmf_api.planes+i[1]*4, vmf_api.planes+i[2]*4, p ) )
+               if( !plane_intersect( planes+i[0]*4, planes+i[1]*4, planes+i[2]*4, p ) )

                        continue;
 
                // Check for illegal verts (eg: got clipped by bisectors)
                int valid = 1;
                for( int m = 0; m < num_planes; m ++ )
                {
                        continue;
 
                // Check for illegal verts (eg: got clipped by bisectors)
                int valid = 1;
                for( int m = 0; m < num_planes; m ++ )
                {

-                       if( plane_polarity( vmf_api.planes+m*4, p ) > 1e-6f )
+                       if( plane_polarity( planes+m*4, p ) > 1e-6f )

                        {
                                valid = 0;
                                break;
                        {
                                valid = 0;
                                break;


@@ -381,7 +359,7 @@ ESolidResult solidgen_push( vmf_solid *ctx, vdf_node *node )
                                        face_add_indice( faces + i[k], c );
                                        
                                        v3d_v3f( p, ctx->verts[ c ].co );
                                        face_add_indice( faces + i[k], c );
                                        
                                        v3d_v3f( p, ctx->verts[ c ].co );

-                                       v3d_v3f( vmf_api.planes+i[k]*4, ctx->verts[ c ].nrm );
+                                       v3d_v3f( planes+i[k]*4, ctx->verts[ c ].nrm );

                                        
                                        csr_sb_inc( ctx->verts, 1 );
                                }
                                        
                                        csr_sb_inc( ctx->verts, 1 );
                                }


@@ -398,7 +376,7 @@ ESolidResult solidgen_push( vmf_solid *ctx, vdf_node *node )
        }
        
        // Sort each faces and trianglulalate them
        }
        
        // Sort each faces and trianglulalate them

-       for( int k = vmf_api.bisectors; k < num_planes; k ++ )
+       for( int k = 0; k < num_planes; k ++ )

        {
                vmf_face *face = faces + k;
        
        {
                vmf_face *face = faces + k;
        


@@ -406,18 +384,15 @@ ESolidResult solidgen_push( vmf_solid *ctx, vdf_node *node )
 
                if( csr_sb_count( face->indices ) < 3 )
                {
 
                if( csr_sb_count( face->indices ) < 3 )
                {

-                       if( !vmf_api.bisectors )
-                       {
-                               flag = k_ESolidResult_degenerate;
-                               fprintf( stderr, "Skipping degenerate face\n" );
-                       }
+                       flag = k_ESolidResult_degenerate;
+                       fprintf( stderr, "Skipping degenerate face\n" );

                        continue;
                }
                
                // Sort only if there is no displacements, or if this side is
                if( !is_displacement || ( is_displacement && face->dispinfo ) )
                {
                        continue;
                }
                
                // Sort only if there is no displacements, or if this side is
                if( !is_displacement || ( is_displacement && face->dispinfo ) )
                {

-                       sort_coplanar( vmf_api.planes+k*4, ctx->verts, face->indices, csr_sb_count( face->indices ) );
+                       sort_coplanar( planes+k*4, ctx->verts, face->indices, csr_sb_count( face->indices ) );

                }
                
                if( is_displacement )
                }
                
                if( is_displacement )


@@ -427,13 +402,8 @@ ESolidResult solidgen_push( vmf_solid *ctx, vdf_node *node )
                        {
                                if( csr_sb_count( face->indices ) != 4 )
                                {
                        {
                                if( csr_sb_count( face->indices ) != 4 )
                                {

-                                       // Mute error if we have global planes cause they
-                                       // are of course gonna fuck things up here
-                                       if( !vmf_api.bisectors )
-                                       {
-                                               flag = k_ESolidResult_degenerate;
-                                               fprintf( stderr, "Skipping degenerate displacement\n" );
-                                       }
+                                       flag = k_ESolidResult_degenerate;
+                                       fprintf( stderr, "Skipping degenerate displacement\n" );

                                        continue;
                                }
                        
                                        continue;
                                }
                        


@@ -458,12 +428,6 @@ ESolidResult solidgen_push( vmf_solid *ctx, vdf_node *node )
                                        }
                                }
                                
                                        }
                                }
                                

-                               // Get corners of displacement
-                               float *SW = ctx->verts[ face->indices[ sw ] ].co;
-                               float *NW = ctx->verts[ face->indices[ (sw+1) % 4] ].co;
-                               float *NE = ctx->verts[ face->indices[ (sw+2) % 4] ].co;
-                               float *SE = ctx->verts[ face->indices[ (sw+3) % 4] ].co;
-                               

                                // Can be either 5, 9, 17
                                numpoints = pow( 2, kv_get_int( dispinfo, "power", 2 ) ) + 1;
                                u32 reqverts = numpoints*numpoints;
                                // Can be either 5, 9, 17
                                numpoints = pow( 2, kv_get_int( dispinfo, "power", 2 ) ) + 1;
                                u32 reqverts = numpoints*numpoints;


@@ -471,6 +435,12 @@ ESolidResult solidgen_push( vmf_solid *ctx, vdf_node *node )
                                
                                ctx->verts = csr_sb_reserve( ctx->verts, reqverts, sizeof( vmf_vert ) );
                                ctx->indices = csr_sb_reserve( ctx->indices, reqidx, sizeof( u32 ) );
                                
                                ctx->verts = csr_sb_reserve( ctx->verts, reqverts, sizeof( vmf_vert ) );
                                ctx->indices = csr_sb_reserve( ctx->indices, reqidx, sizeof( u32 ) );

+
+                               // Get corners of displacement
+                               float *SW = ctx->verts[ face->indices[ sw ] ].co;
+                               float *NW = ctx->verts[ face->indices[ (sw+1) % 4] ].co;
+                               float *NE = ctx->verts[ face->indices[ (sw+2) % 4] ].co;
+                               float *SE = ctx->verts[ face->indices[ (sw+3) % 4] ].co;

                                
                                float normals[ 17*3 ];
                                float distances[ 17 ];
                                
                                float normals[ 17*3 ];
                                float distances[ 17 ];