fix(ecs): reading a component grows the SparseArray, so a bad id can exhaust WASM memory

未關閉
  • 哪裡不對？
#491 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
4/5
預估耗時
3-5 天
新手友好度
55/100
Issue 類型
缺陷
描述清晰度
描述清楚
活躍度
活躍
技術堆疊
cpp, typescript, wasm
領域
backend, game-dev

研究方向

Start with the cited SparseArray.hpp operator[] and the Registry.hpp getEntityComponent and add_component entry points. Trace how reads handle out-of-range ids and how component registration and entity liveness are checked. Reproduce the large-id and SIZE_MAX cases, then run the relevant ECS/WASM tests; done means reads cannot grow the array and invalid entity ids are rejected safely.

由索引模型根據 Issue 內容生成。

描述

bug modules:ecs
Which package is this bug report for?

ecs

Issue description

getEntityComponent and the embind get(idx) use the non-const operator[], which resizes on read: one stale or garbage id (e.g. 1e9) aborts the WASM heap. add_component accepts ids that were never spawned, and reads register component types as a side effect. On wasm32, idx == SIZE_MAX makes idx + 1 overflow to 0.

Where:

Evidence:

reference_type operator[](size_type idx)
{
    if (idx >= _data.size()) { _data.resize(idx + 1); }
    return _data[idx];
}

Suggested fix: Use a read path that does not grow the array (return empty when out of range), and bounds-check add_component against _next_entity and the alive state.

Found during a code audit of main at be72076.

Code sample

No response

Versions
  • Engine main at be72076
  • pnpm 12.0.0, Node.js 26, Bun 1.3.14
Issue priority

Medium (should be fixed soon)

I have tested this issue on a development release

be72076

主要語言
TypeScript
星號
7
分支
2
平均合併
1 天 17 小時
30 天內合併 PR
17

環境準備

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

NanoForge-dev/Engine 的其他 Issue

查看 NanoForge-dev/Engine 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。