Skip to content

Fix Bullet Physics: memory access out of bounds #18750

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 29, 2025

Conversation

bofeng-song
Copy link
Contributor

Re: #
#18613

Changelog


Continuous Integration

This pull request:

  • needs automatic test cases check.

    Manual trigger with @cocos-robot run test cases afterward.

  • does not change any runtime related code or build configuration

    If any reviewer thinks the CI checks are needed, please uncheck this option, then close and reopen the issue.


Compatibility Check

This pull request:

  • changes public API, and have ensured backward compatibility with deprecated features.
  • affects platform compatibility, e.g. system version, browser version, platform sdk version, platform toolchain, language version, hardware compatibility etc.
  • affects file structure of the build package or build configuration which requires user project upgrade.
  • introduces breaking changes, please list all changes, affected features and the scope of violation.

const quat = BulletCache.instance.BT_QUAT_0;
const trans0 = bt.Transform_new();
const trans1 = bt.Transform_new();
const quat = bt.Quat_new(0, 0, 0, 1);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not use BulletCache here ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It`s a pointer in native, and its value will be changed later.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Such as this interface: 
void DLL_EXPORT Transform_setRotation(int ptr, int q)
{
    btTransform *trans = (btTransform *)ptr;
    trans->setRotation(*(btQuaternion *)q);
}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems bt._safe_delete will also invalidate the pointer. I can't tell the difference between the two methods.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BulletCache.instance.xx will be used multi times, and its value will be changed after calling c++ interface.
bt.Quat_new and bt.Transform_new ensure that values created multiple times remain consistent and are unaffected by external factors.

Copy link

Code Size Check Report

Wechat (WASM) Before After Diff
2D Empty (legacy pipeline) 1005977 bytes 1005977 bytes ✅ 0 bytes
2D All (legacy pipeline) 2671042 bytes 2671042 bytes ✅ 0 bytes
2D All (new pipeline) 2760514 bytes 2760514 bytes ✅ 0 bytes
(2D + 3D) All 10016463 bytes 10016829 bytes ⚠️ +366 bytes
Web (WASM + ASMJS) Before After Diff
(2D + 3D) All 16838084 bytes 16838450 bytes ⚠️ +366 bytes

Interface Check Report

This pull request does not change any public interfaces !

@star-e
Copy link
Contributor

star-e commented May 29, 2025

@cocos-robot run-test-cases-custom

Copy link

@bofeng-song, Please check the result of run test cases:

Task Details

Platform build boot runned crashScene FailScene
web-mobile PASS PASS FAIL particle-velocity,scroll-view-scroll-to-offset
ios PASS PASS PASS
mac PASS PASS PASS

Copy link

@bofeng-song, Please check the result of run test cases:

Task Details

@star-e star-e merged commit 068e0aa into cocos:v3.8.7 May 29, 2025
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants