Fix client crash from invalid COL header sizes#5045
Open
HeresHavi wants to merge 1 commit into
Open
Conversation
Reject truncated or underflowing COL entries before passing their data to GTA's collision parsers. Preserve support for COL archives containing trailing entries.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Added COL size validation to
CRenderWareSA::ReadCOLbefore creating a collision model or calling GTA's parser.Malformed entries are now rejected when the declared size is too small, extends beyond the supplied buffer, or cannot contain the required COL2 or COL3 header.
Motivation
CRenderWareSA::ReadCOLsubtracted the 24-byte model-name section from the declared COL size without checking it first. A declared size below 24 could underflow into a very large unsigned value and be passed to GTA.For example, a resource might load custom collision data downloaded with a map. If that data is truncated or has a broken size field, calling
engineLoadCOLcould send the invalid length into GTA's collision parser and crash the player's client.The validated size is now reused when calling GTA, while COL archives containing trailing entries remain supported.
Crash Stack
Test plan
Runtime
COL2buffer with a declared size of zero caused an access violation insideLoadCollisionModelVer2.false, and the client stayed open.Builds and Tests
Debug | Win32:Game SAbuild passed.Release | Win32:Game SAbuild passed.clang-format.Checklist