Skip to content

Fix plain texture pixel size overflow#5044

Open
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-texture-pixel-size-overflow
Open

Fix plain texture pixel size overflow#5044
HeresHavi wants to merge 1 commit into
multitheftauto:masterfrom
HeresHavi:fix-texture-pixel-size-overflow

Conversation

@HeresHavi

@HeresHavi HeresHavi commented Jul 13, 2026

Copy link
Copy Markdown

Summary

Changed the plain-pixel size check in CPixelsManager::GetPlainDimensions to use 64-bit arithmetic.

Large width and height values can no longer wrap into a smaller buffer size and pass validation.

Motivation

The expected plain-pixel size was calculated using 32-bit arithmetic. Dimensions of 32768 × 32769 require a little over 4 GiB, but the calculation wrapped to only 131076 bytes.

The undersized buffer was then accepted by dxSetTexturePixels. Its claimed width produced a source row pitch of 131072 bytes, causing later rows to be read beyond the supplied Lua string.

For example, a client resource might generate pixel data for a texture effect. If its width or height metadata becomes corrupted or is calculated incorrectly, the old validation could accept the buffer and crash the player's client during the copy.

Crash Stack
Exception: Access violation

memcpy
CPixelsManager::SetSurfacePixels (CPixelsManager.cpp:443)
CPixelsManager::SetTexturePixels (CPixelsManager.cpp:214)
CLuaDrawingDefs::DxSetTexturePixels (CLuaDrawingDefs.cpp:1887)
Crash

Test plan

Runtime

  • Valid Case: A normal 64 × 64 plain-pixel buffer containing 16388 bytes returned true before and after the fix.
  • Before Fix: A 131076-byte buffer claiming dimensions of 32768 × 32769 caused an access violation in CPixelsManager::SetSurfacePixels.
  • After Fix: The exact same malformed buffer returned false, and the client stayed open.

Builds and Tests

  • Debug | Win32: Full rebuild passed.
  • Release | Win32: Full rebuild passed.
  • Debug | x64: Full rebuild passed.
  • Release | x64: Full rebuild passed.
  • Ran clang-format.

Checklist

  • Your code should follow the coding guidelines.
  • Smaller pull requests are easier to review. If your pull request is beefy, your pull request should be reviewable commit-by-commit.

Validate plain-pixel buffer dimensions using 64-bit arithmetic so large
dimensions cannot wrap to an undersized accepted buffer and cause an
out-of-bounds read in dxSetTexturePixels.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant