Unhandled Exception in `llviewerparceloverlay` when accessing `mOwnership[4096]`
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 82/100
Research direction
Start in indra/newview/llviewerparceloverlay.cpp around lines 238-262 and inspect how col, row, and GRIDS_PER_EDGE are used before indexing mOwnership. Reproduce the crash with an object whose bounding box reaches x = 256 and y = 256 while the Build floater is open. Done means the boundary case no longer reads beyond mOwnership[4095] or crashes.
Written by the indexing model from the issue text.
Description
Environment
Alchemy Test 26.4 but issue is upstream in current viewer code after looking into root cause
Description
llviewerparceloverlay.cpp tried to access mOwnership[4096] per:
U8 north_overlay = mOwnership[(row+1)*GRIDS_PER_EDGE+col];
With local variables set to: (per attached debugger)
col = 64
GRIDS_PER_EDGE = 64
row = 62
Which results in: (62+1)*64 + 64 = 4096
mOwnership is only buffered to 4096
Relevant code is:
https://github.com/secondlife/viewer/blob/c179f76c01a93fe6a46318be0e1c23a9d3089ddb/indra/newview/llviewerparceloverlay.cpp#L238-L262
Notice there are no guards for when col or row are 64 in either opposite condition, even though their values are used across both.
Reproduction steps
Got it randomly on right-click > edit on an object I was wanting to edit, think I misclicked onto a 256m megaprim which triggered the fault
To reproduce it, select any object whose bounding box reaches both x = 256 and y = 256 while the Build floater is open. It crashes only when the heap block happens to end on a page boundary; otherwise the read quietly returns a garbage byte.
- Dominant language
- C++
- Stars
- 310
- Forks
- 155
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 111
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from secondlife/viewer
-
RebuildGeom rebuilds vertex buffers needlesslyPossibly taken @trish-sl claimed this today. Opentriage
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
secondlife/viewer#6653 ·
Maintainers usually reply within 1 day
-
gObjectFullbrightAlphaMaskProgram in newview/llviewershadermgr.cpp is defined but never initializedPossibly taken @maxim-productengine claimed this 3 days ago. Openbug
Difficulty 1/5 Under an hour Newbie friendliness 78/100
secondlife/viewer#6620 · 1 assignee ·
Maintainers usually reply within 1 day
-
viewer 26.5 should enable "Send GameControl Data to server" by defaultPossibly taken @AndrewMeadows claimed this 11 days ago. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
secondlife/viewer#6507 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
Typo in "Copy to Inventory" on Textures opened from NotecardPossibly taken @maxim-productengine claimed this 25 days ago. Openbug
Difficulty 1/5 Under an hour Newbie friendliness 72/100
secondlife/viewer#6432 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
LEAP API for LLMediaAPI missing ReqIDPossibly taken A pull request linked to this issue is open or already merged. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
secondlife/viewer#6421 ·
Maintainers usually reply within 1 day
All issues in secondlife/viewer
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Niko1221/Strata#5560 · 2 comments ·
Maintainers usually reply within 4 days
-
NVIDIA windows
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
要トリアージ 辞書
Difficulty 1/5 1-3 hours Newbie friendliness 86/100
yksr-melt/Meltype#1625 · 1 reaction ·
Maintainers usually reply within 1 day
-
kind/bug priority/medium qa_automation
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
yugabyte/yugabyte-db#37324 ·
Maintainers usually reply within 1 day