Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gltf: basis universal crash due OOB index into source_images using texture index #80316

Closed
lyuma opened this issue Aug 6, 2023 · 0 comments · Fixed by #80314
Closed

gltf: basis universal crash due OOB index into source_images using texture index #80316

lyuma opened this issue Aug 6, 2023 · 0 comments · Fixed by #80314

Comments

@lyuma
Copy link
Contributor

lyuma commented Aug 6, 2023

Godot version

4.0 - 4.2dev2

System information

Godot v4.2.dev2 - Windows 10.0.19045 - Vulkan (Forward+) - dedicated NVIDIA GeForce RTX 3090 (NVIDIA; 31.0.15.3640) - Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz (16 Threads)

Issue description

Total basis file slices: 11
Slice: 0, alpha: 0, orig width/height: 512x1024, width/height: 512x1024, first_block: 0, image_index: 0, mip_level: 0, iframe: 0
Slice: 1, alpha: 0, orig width/height: 256x512, width/height: 256x512, first_block: 32768, image_index: 0, mip_level: 1, iframe: 0
Slice: 2, alpha: 0, orig width/height: 128x256, width/height: 128x256, first_block: 40960, image_index: 0, mip_level: 2, iframe: 0
Slice: 3, alpha: 0, orig width/height: 64x128, width/height: 64x128, first_block: 43008, image_index: 0, mip_level: 3, iframe: 0
Slice: 4, alpha: 0, orig width/height: 32x64, width/height: 32x64, first_block: 43520, image_index: 0, mip_level: 4, iframe: 0
Slice: 5, alpha: 0, orig width/height: 16x32, width/height: 16x32, first_block: 43648, image_index: 0, mip_level: 5, iframe: 0
Slice: 6, alpha: 0, orig width/height: 8x16, width/height: 8x16, first_block: 43680, image_index: 0, mip_level: 6, iframe: 0
Slice: 7, alpha: 0, orig width/height: 4x8, width/height: 4x8, first_block: 43688, image_index: 0, mip_level: 7, iframe: 0
Slice: 8, alpha: 0, orig width/height: 2x4, width/height: 4x4, first_block: 43690, image_index: 0, mip_level: 8, iframe: 0
Slice: 9, alpha: 0, orig width/height: 1x2, width/height: 4x4, first_block: 43691, image_index: 0, mip_level: 9, iframe: 0
Slice: 10, alpha: 0, orig width/height: 1x1, width/height: 4x4, first_block: 43692, image_index: 0, mip_level: 10, iframe: 0
ERROR: FATAL: Index p_index = 42 is out of bounds (size() = 42).
   at: CowData<class Ref<class Image> >::get (S:\repo\godot-fire\core/templates/cowdata.h:155)

================================================================
CrashHandlerException: Program crashed
Engine version: Godot Engine v4.2.dev.custom_build (85ff82196504f013409f94b89708758e13cc4076)
Dumping the backtrace. Please include this when reporting the bug to the project developer.
[0] GLTFDocument::_get_texture (S:\repo\godot-fire\modules\gltf\gltf_document.cpp:3393)
[1] GLTFDocument::_parse_materials (S:\repo\godot-fire\modules\gltf\gltf_document.cpp:3932)
[2] GLTFDocument::_parse_gltf_state (S:\repo\godot-fire\modules\gltf\gltf_document.cpp:7390)
[3] GLTFDocument::_parse (S:\repo\godot-fire\modules\gltf\gltf_document.cpp:7026)
[4] GLTFDocument::append_from_file (S:\repo\godot-fire\modules\gltf\gltf_document.cpp:7454)
[5] call_with_variant_args_ret_helper<GLTFDocument,enum Error,String,Ref<GLTFState>,unsigned int,String,0,1,2,3> (S:\repo\godot-fire\core\variant\binder_common.h:755)
[6] call_with_variant_args_ret_dv<GLTFDocument,enum Error,String,Ref<GLTFState>,unsigned int,String> (S:\repo\godot-fire\core\variant\binder_common.h:534)
[7] MethodBindTR<GLTFDocument,enum Error,String,Ref<GLTFState>,unsigned int,String>::call (S:\repo\godot-fire\core\object\method_bind.h:494)
[8] GDScriptFunction::call (S:\repo\godot-fire\modules\gdscript\gdscript_vm.cpp:1779)
[9] GDScriptInstance::callp (S:\repo\godot-fire\modules\gdscript\gdscript.cpp:1892)
[10] Object::callp (S:\repo\godot-fire\core\object\object.cpp:719)
[11] Variant::callp (S:\repo\godot-fire\core\variant\variant_call.cpp:1174)
[12] GDScriptFunction::call (S:\repo\godot-fire\modules\gdscript\gdscript_vm.cpp:1661)
[13] GDScriptLambdaSelfCallable::call (S:\repo\godot-fire\modules\gdscript\gdscript_lambda_callable.cpp:155)
[14] Callable::callp (S:\repo\godot-fire\core\variant\callable.cpp:51)
[15] Object::emit_signalp (S:\repo\godot-fire\core\object\object.cpp:1073)
[16] Node::emit_signalp (S:\repo\godot-fire\scene\main\node.cpp:3571)
[17] Window::_window_drop_files (S:\repo\godot-fire\scene\main\window.cpp:1483)
[18] CallableCustomMethodPointer<Window,Vector<String> const &>::call (S:\repo\godot-fire\core\object\callable_method_pointer.h:104)
[19] Callable::callp (S:\repo\godot-fire\core\variant\callable.cpp:51)
[20] DisplayServerWindows::WndProc (S:\repo\godot-fire\platform\windows\display_server_windows.cpp:3881)
[21] WndProc (S:\repo\godot-fire\platform\windows\display_server_windows.cpp:3901)
[22] <couldn't map PC to fn name>
[23] <couldn't map PC to fn name>
[24] <couldn't map PC to fn name>
[25] <couldn't map PC to fn name>
[26] <couldn't map PC to fn name>
[27] DisplayServerWindows::process_events (S:\repo\godot-fire\platform\windows\display_server_windows.cpp:2290)
[28] OS_Windows::run (S:\repo\godot-fire\platform\windows\os_windows.cpp:1479)
[29] widechar_main (S:\repo\godot-fire\platform\windows\godot_windows.cpp:182)
[30] _main (S:\repo\godot-fire\platform\windows\godot_windows.cpp:206)
[31] main (S:\repo\godot-fire\platform\windows\godot_windows.cpp:226)
[32] __scrt_common_main_seh (D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288)
[33] <couldn't map PC to fn name>
-- END OF BACKTRACE --
================================================================

PR: #80314

Steps to reproduce

  1. Play the load_at_runtime_scene.tscn from the godot-vrm project project
  2. drag the rotation constraint test model
  3. it will crash due to index out of bounds.

Minimal reproduction project

load this project: this version of godot-vrm: https://github.com/V-Sekai/godot-vrm/tree/591d33e89e50de8fc5a16880bdd01237b083df37

Use a buggy re-export of the rotation constraint test model mirrored here:

re-exported 47999701980962516models1854603302827712615.zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants