浏览代码

Fix memory access error for `MultiMesh` with GLES3

Buffer was incorrectly assigned when invalid data was provided

(cherry picked from commit 6cb28e481f72d6fa1b2d06ff1e0c8664dcbd22ca)
A Thousand Ships 2 年之前
父节点
当前提交
4e539028fb
共有 1 个文件被更改,包括 4 次插入2 次删除
  1. 4 2
      drivers/gles3/storage/mesh_storage.cpp

+ 4 - 2
drivers/gles3/storage/mesh_storage.cpp

@@ -1685,14 +1685,16 @@ void MeshStorage::multimesh_set_buffer(RID p_multimesh, const Vector<float> &p_b
 		// Color and custom need to be packed so copy buffer to data_cache and pack.
 		// Color and custom need to be packed so copy buffer to data_cache and pack.
 
 
 		_multimesh_make_local(multimesh);
 		_multimesh_make_local(multimesh);
-		multimesh->data_cache = p_buffer;
 
 
-		float *w = multimesh->data_cache.ptrw();
 		uint32_t old_stride = multimesh->xform_format == RS::MULTIMESH_TRANSFORM_2D ? 8 : 12;
 		uint32_t old_stride = multimesh->xform_format == RS::MULTIMESH_TRANSFORM_2D ? 8 : 12;
 		old_stride += multimesh->uses_colors ? 4 : 0;
 		old_stride += multimesh->uses_colors ? 4 : 0;
 		old_stride += multimesh->uses_custom_data ? 4 : 0;
 		old_stride += multimesh->uses_custom_data ? 4 : 0;
 		ERR_FAIL_COND(p_buffer.size() != (multimesh->instances * (int)old_stride));
 		ERR_FAIL_COND(p_buffer.size() != (multimesh->instances * (int)old_stride));
 
 
+		multimesh->data_cache = p_buffer;
+
+		float *w = multimesh->data_cache.ptrw();
+
 		for (int i = 0; i < multimesh->instances; i++) {
 		for (int i = 0; i < multimesh->instances; i++) {
 			{
 			{
 				float *dataptr = w + i * old_stride;
 				float *dataptr = w + i * old_stride;