fix mesh data heap corruption (#399)

meta4d-me · Sep 22, 2023 · 9566c07 · 9566c07
1 parent b1cf9b6
commit 9566c07
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 11 deletions.
diff --git a/Engine/Source/Runtime/ECWorld/StaticMeshComponent.cpp b/Engine/Source/Runtime/ECWorld/StaticMeshComponent.cpp
@@ -291,7 +291,7 @@ void StaticMeshComponent::BuildWireframeData()
 
 	uint32_t wireframeIndicesCount = bgfx::topologyConvert(bgfx::TopologyConvert::TriListToLineList, nullptr, 0U,
 		m_indexBuffer.data(), indicesCount, !useU16Index);
-	m_wireframeIndexBuffer.resize(indicesCount * indexTypeSize);
+	m_wireframeIndexBuffer.resize(wireframeIndicesCount * indexTypeSize);
 	bgfx::topologyConvert(bgfx::TopologyConvert::TriListToLineList, m_wireframeIndexBuffer.data(), static_cast<uint32_t>(m_wireframeIndexBuffer.size()),
 		m_indexBuffer.data(), indicesCount, !useU16Index);
 }
@@ -311,17 +311,19 @@ void StaticMeshComponent::BuildProgressiveMeshData()
 
 	m_originVertexCount = m_currentVertexCount;
 	m_originPolygonCount = m_currentPolygonCount;
-	m_progressiveMeshIndexBuffer.resize(m_currentPolygonCount * 3U);
 
 	// Copy and modify buffer.
 	assert(!m_vertexBuffer.empty());
 	uint32_t vertexStride = m_pRequiredVertexFormat->GetStride();
+	assert(vertexStride * m_currentVertexCount == m_vertexBuffer.size());
 
 	// Create a vertex buffer sorted by collape order.
 	m_progressiveMeshVertexBuffer.resize(m_vertexBuffer.size());
 	for (uint32_t vertexIndex = 0U; vertexIndex < m_currentVertexCount; ++vertexIndex)
 	{
-		std::memcpy(m_progressiveMeshVertexBuffer.data() + m_permutation[vertexIndex] * vertexStride, m_vertexBuffer.data() + vertexIndex * vertexStride, vertexStride);
+		uint32_t newVertexIndex = m_permutation[vertexIndex];
+		assert(newVertexIndex < m_currentVertexCount);
+		std::memcpy(m_progressiveMeshVertexBuffer.data() + newVertexIndex * vertexStride, m_vertexBuffer.data() + vertexIndex * vertexStride, vertexStride);
 	}
 
 	// After sorting vertex buffer, modify index buffer accordingly.
@@ -331,20 +333,26 @@ void StaticMeshComponent::BuildProgressiveMeshData()
 
 	if (useU16Index)
 	{
+		using IndexType = uint16_t;
 		for (uint32_t indexIndex = 0U; indexIndex < m_currentPolygonCount * 3U; ++indexIndex)
 		{
-			auto* pIndexData = reinterpret_cast<uint16_t*>(m_indexBuffer.data() + indexIndex * indexTypeSize);
-			uint16_t index = *pIndexData;
-			std::memcpy(m_progressiveMeshIndexBuffer.data() + indexIndex * indexTypeSize, &m_permutation[index], indexTypeSize);
+			auto* pIndexData = reinterpret_cast<IndexType*>(m_indexBuffer.data() + indexIndex * indexTypeSize);
+			IndexType index = *pIndexData;
+			assert(m_permutation[index] < m_currentVertexCount);
+			IndexType newIndex = static_cast<IndexType>(m_permutation[index]);
+			std::memcpy(m_progressiveMeshIndexBuffer.data() + indexIndex * indexTypeSize, &newIndex, indexTypeSize);
 		}
 	}
 	else
 	{
+		using IndexType = uint32_t;
 		for (uint32_t indexIndex = 0U; indexIndex < m_currentPolygonCount * 3U; ++indexIndex)
 		{
-			auto* pIndexData = reinterpret_cast<uint32_t*>(m_indexBuffer.data() + indexIndex * indexTypeSize);
-			uint32_t index = *pIndexData;
-			std::memcpy(m_progressiveMeshIndexBuffer.data() + indexIndex * indexTypeSize, &m_permutation[index], indexTypeSize);
+			auto* pIndexData = reinterpret_cast<IndexType*>(m_indexBuffer.data() + indexIndex * indexTypeSize);
+			IndexType index = *pIndexData;
+			assert(m_permutation[index] < m_currentVertexCount);
+			IndexType newIndex = m_permutation[index];
+			std::memcpy(m_progressiveMeshIndexBuffer.data() + indexIndex * indexTypeSize, &newIndex, indexTypeSize);
 		}
 	}
 

diff --git a/Engine/Source/Runtime/ECWorld/StaticMeshComponent.h b/Engine/Source/Runtime/ECWorld/StaticMeshComponent.h
@@ -85,10 +85,9 @@ class StaticMeshComponent final
 	uint16_t m_wireframeIndexBufferHandle = UINT16_MAX;
 
 	std::vector<std::byte> m_progressiveMeshVertexBuffer;
-	uint16_t m_progressiveMeshVertexBufferHandle = UINT16_MAX;
-
 	std::vector<std::byte> m_progressiveMeshIndexBuffer;
 	uint16_t m_progressiveMeshIndexBufferHandle = UINT16_MAX;
+	uint16_t m_progressiveMeshVertexBufferHandle = UINT16_MAX;
 
 	uint32_t m_originVertexCount = UINT32_MAX;
 	uint32_t m_originPolygonCount = UINT32_MAX;