Repository navigation
Three buffer overruns: compound tree stacks, hull clip polygons, mesh cast stacks - #102
Merged
Merged
Conversation
…lock - compound: a baked tree carried one traversal stack in the compound's block (2 KB), but tree queries take a worker's share of a tree's stack (12 KB a worker), so a query on any worker past the first wrote 12 KB a worker beyond it into the heap -- reached from the parallel continuous pass, bullets swept against a compound. Baked trees point at the module's own per-worker stacks now (query and distance), made with the module's scratch; the block holds none. dynamic_tree exports the share sizes (query_stack_bytes, query_dist_bytes). - manifold: the hull clip polygons held 64 vertices, but an incident face of up to 64 sides clipped against a reference face of up to 64 can reach 128 (two 40-sided cylinders cap to cap at a twist give an 80-gon); the last worker's spilled past the allocation. They hold 128 now. - mesh: the ray and shape casts pushed the far child at every level unguarded, so a tree leaning right deeper than the 256-entry stack overran it; every mesh traversal's push is guarded now (a pathological tree drops the far subtree rather than write past the stack). Tests: test_compound_workers casts as workers 1, 7, 31 and 63 (main crashes); test_wide_faces collides 40-sided cylinders as the last worker; test_deep_tree_cast casts through a 300-deep right spine as the last worker. test_compound's permanent allocations grow by the two stacks.
…on count The baked trees' per-worker stacks are the compound module's scratch now, made on first use; test_compound_pairs made them inside the counted region.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I audited every fixed-size scratch block and buffer in the library against the real limits of what gets written into it. Three can be overrun.
dynamic_treeexports the per-worker sizes (query_stack_bytes,query_dist_bytes).triangle_manifold's already did.Tests, each run as a high worker index so an overrun lands past the allocation:
test_compound_workers: compound ray cast as workers 1, 7, 31 and 63. Main crashes with an access violation.test_wide_faces: 40-sided cylinders collided as worker 63.test_deep_tree_cast: a ray cast through a 300-deep right spine as worker 63.On main, the last two overrun into memory that happens to be writable, so they don't fail there; they guard the result going forward.
test_compound's permanent allocation count grows by the two new stacks. All 28 test programs pass locally on aether 0.772.0, with no warnings.