From 4dfdfc12b2a07bbe1fa78180a99b5cc635476950 Mon Sep 17 00:00:00 2001 From: Fabio Pedretti Date: Sun, 16 Aug 2026 14:59:43 +0200 Subject: [PATCH] Fix: Prevent out-of-bounds memory access in CheckBuildingPlacement In `CCmpPathfinder::CheckBuildingPlacement`, the boundary check for the vertical grid dimension (`j > m_TerrainOnlyGrid->m_H`) allowed `j` to equal `m_TerrainOnlyGrid->m_H`. Since grid indices are 0-based (valid row indices range from `0` to `m_H - 1`), this boundary condition allowed the loop to execute with an out-of-bounds row index, leading to an invalid memory read (`m_TerrainOnlyGrid->get(i, j)`) and potential segfaults. This patch changes the comparison operator to `j >= m_TerrainOnlyGrid->m_H`, ensuring that spans extending to or past the grid height bound are properly flagged as out-of-bounds. --- source/simulation2/components/CCmpPathfinder.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source/simulation2/components/CCmpPathfinder.cpp b/source/simulation2/components/CCmpPathfinder.cpp index 14137f0a7d..eaca670a40 100644 --- a/source/simulation2/components/CCmpPathfinder.cpp +++ b/source/simulation2/components/CCmpPathfinder.cpp @@ -1,4 +1,4 @@ -/* Copyright (C) 2025 Wildfire Games. +/* Copyright (C) 2026 Wildfire Games. * This file is part of 0 A.D. * * 0 A.D. is free software: you can redistribute it and/or modify @@ -1051,7 +1051,7 @@ ICmpObstruction::EFoundationCheck CCmpPathfinder::CheckBuildingPlacement(const I i16 j = span.j; // Fail if any span extends outside the grid - if (i0 < 0 || i1 > m_TerrainOnlyGrid->m_W || j < 0 || j > m_TerrainOnlyGrid->m_H) + if (i0 < 0 || i1 > m_TerrainOnlyGrid->m_W || j < 0 || j >= m_TerrainOnlyGrid->m_H) return ICmpObstruction::FOUNDATION_CHECK_FAIL_TERRAIN_CLASS; // Fail if any span includes an impassable tile