Skip to content

bugfix(projectile): Fix out-of-bounds access in DumbProjectile which causes mismatch with very high speed weapons at small hit distances #2087

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Caball009 wants to merge 13 commits into
base: main
Choose a base branch
from
Open

bugfix(projectile): Fix out-of-bounds access in DumbProjectile which causes mismatch with very high speed weapons at small hit distances #2087

Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
78d3a10
bugfix(projectile): Fix out-of-bounds access bug in DumbProjectile ca…
Caball009 Jan 10, 2026
f72e7ca
Removed attempt at garbage values.
Caball009 Jan 10, 2026
41925dd
Added 'TheSuperHackers' comment.
Caball009 Jan 10, 2026
5def8f8
Improved comment.
Caball009 Jan 10, 2026
aaaa3af
Fixed invalid direction.
Caball009 Jan 10, 2026
21d47d5
Changed initializer list to member function.
Caball009 Jan 10, 2026
b7cf3ed
Removed blank line.
Caball009 Jan 10, 2026
56e2c9c
Changed logic to account for delay by a single frame.
Caball009 Jan 22, 2026
2827c3c
Fixed size check.
Caball009 Jan 22, 2026
5bd555a
Moved assertion out of retail compatibility block.
Caball009 Jan 22, 2026
a97e907
Simplified by unifying retail and non-retail code.
Caball009 Jan 22, 2026
b4999b8
Put assertion behind retail only macro.
Caball009 Jan 25, 2026
7e14f8f
Set flightStep with correct values.
Caball009 Jan 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 27 additions & 3 deletions GeneralsMD/Code/GameEngine/Source/GameLogic/Object/Behavior/DumbProjectileBehavior.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -446,7 +446,10 @@ Bool DumbProjectileBehavior::calcFlightPath(Bool recalcNumSegments)
Real flightDistance = flightCurve.getApproximateLength();
m_flightPathSegments = ceil( flightDistance / m_flightPathSpeed );
}
flightCurve.getSegmentPoints( m_flightPathSegments, &m_flightPath );

// TheSuperHackers @info The way flight paths are used requires at least two curve points.
// DumbProjectileBehavior::update has been modified to handle cases where the flight path consists of one or zero curve points.
flightCurve.getSegmentPoints(m_flightPathSegments, &m_flightPath);
DEBUG_ASSERTCRASH(m_flightPathSegments == m_flightPath.size(), ("m_flightPathSegments mismatch"));

#if defined(RTS_DEBUG)
Expand Down Expand Up @@ -584,6 +587,7 @@ UpdateSleepTime DumbProjectileBehavior::update()
return UPDATE_SLEEP_NONE;
}

// TheSuperHackers @info This check also covers the case where the flight path consists of zero curve points.
if( m_currentFlightPathStep >= m_flightPath.size() )
{
// No more steps to use. Would go out of bounds on vector, so have to do something.
Expand Down Expand Up @@ -648,8 +652,28 @@ UpdateSleepTime DumbProjectileBehavior::update()
//long, blurry projectile graphics which look badly oriented on step 0 of the flight path
// so lets orient it the same as if it were on frame 1!
{
Coord3D prevPos = m_flightPath[0];
Coord3D curPos = m_flightPath[1];
// TheSuperHackers @bugfix Caball009 10/01/2026 Check vector size before accessing the second element to prevent out of bounds access.
// The non-deterministic behavior for retail clients cannot be fixed, so this will remain a source of potential mismatches in retail compatibility mode.
// Use the flight path start and end coordinates if needed, so that the behavior is deterministic for patched clients.
Coord3D prevPos;
Coord3D curPos;

if (m_flightPath.size() >= 2)
{
prevPos = m_flightPath[0];
curPos = m_flightPath[1];
}
else
{
#if RETAIL_COMPATIBLE_CRC
DEBUG_CRASH(("A mismatch is likely to happen if this code path is used in a match with unpatched clients."
" Vector is expected to contain two or more elements; check the weapon speed value."));
#endif

flightStep = m_flightPathStart;
prevPos = m_flightPathStart;
curPos = m_flightPathEnd;
}

Vector3 curDir(curPos.x - prevPos.x, curPos.y - prevPos.y, curPos.z - prevPos.z);
curDir.Normalize(); // buildTransformMatrix wants it this way
Expand Down
Loading