Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RE_GenerateTexture: endlessly incrementing global signed integer is asking for overflow #271

Open
illwieckz opened this issue Jan 13, 2020 · 1 comment
Labels
bug

Comments

@illwieckz
Copy link
Member

@illwieckz illwieckz commented Jan 13, 2020

See here:

int numTextures = 0;
qhandle_t RE_GenerateTexture( const byte *pic, int width, int height )
{
const char *name = va( "rocket%d", numTextures++ );

Everytime a libRocket element is displayed for the first time, this global signed integer is incremented, but this is never reset on map load, hence this global variable is incremented endlessly:

]/imagelist rocket

      -w-- -h-- -mm- -type- -if---- -srgb-- -swrap- -twrap-- -name--------
  90:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket0
  91:  256  256 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket1
 ---------
 196608 total texels (not including mipmaps)
 0.75 MB total image memory
 93 total images

]/devmap plat23

]/imagelist rocket

      -w-- -h-- -mm- -type- -if---- -srgb-- -swrap- -twrap-- -name--------
  95:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket4
  96:  256  256 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket5
  97:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket6
  99:  512 1024 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket7
 100:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket8
 725:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket9
 ---------
 1114112 total texels (not including mipmaps)
 4.25 MB total image memory
 727 total images

]/devmap chasm

]/imagelist rocket

      -w-- -h-- -mm- -type- -if---- -srgb-- -swrap- -twrap-- -name--------
  95:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket11
  96:  256  256 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket12
  97:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket13
  99:  512 1024 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket14
 100:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket15
 832:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket16
 ---------
 1114112 total texels (not including mipmaps)
 4.25 MB total image memory
 834 total images

Debug: clientCommand: illwieckz [granger] : 3 : team human
Debug: EXCL: team human
illwieckz [granger] joined the humans
Debug: Setting binding team index to 2
Debug: clientCommand: illwieckz [granger] : 4 : class rifle
Debug: EXCL: class rifle
Debug: loading 'ui/assets/circlemenu/circle-hover' image as shader
Debug: loading 'ui/assets/circlemenu/circle' image as shader

]/imagelist rocket

      -w-- -h-- -mm- -type- -if---- -srgb-- -swrap- -twrap-- -name--------
  95:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket11
  96:  256  256 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket12
  97:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket13
  99:  512 1024 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket14
 100:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket15
 832:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket16
 836:  512  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket17
 ---------
 1376256 total texels (not including mipmaps)
 5.25 MB total image memory
 837 total images

Debug: clientCommand: illwieckz [granger] : 5 : team alien
Debug: EXCL: team alien
illwieckz [granger] left the humans and joined the aliens
Debug: Setting binding team index to 1
Debug: clientCommand: illwieckz [granger] : 6 : class level0
Debug: EXCL: class level0

]/kill
Debug: clientCommand: illwieckz [granger] : 7 : kill
Debug: EXCL: kill
●illwieckz [granger] was killed by ●noname
Debug: clientCommand: illwieckz [granger] : 8 : class builderupg builder
Debug: EXCL: class builderupg builder
]/imagelist rocket

      -w-- -h-- -mm- -type- -if---- -srgb-- -swrap- -twrap-- -name--------
  95:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket11
  96:  256  256 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket12
  97:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket13
  99:  512 1024 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket14
 100:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket15
 832:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket16
 836:  512  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket17
 837:  512  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket18
 838: 1024 1024 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket19
 840:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket20
 841:  256  256 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket21
 842:  256  256 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket22
 ---------
 2949120 total texels (not including mipmaps)
 11.25 MB total image memory
 843 total images

]/devmap antares

]/imagelist rocket

      -w-- -h-- -mm- -type- -if---- -srgb-- -swrap- -twrap-- -name--------
  95:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket24
  96:  256  256 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket25
  97:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket26
  99:  512 1024 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket27
 100:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket28
 763:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket29
 ---------
 1114112 total texels (not including mipmaps)
 4.25 MB total image memory
 765 total images

I found this while I was hacking with sRGB stuff: I was looking for that new srgb column I just wrote… I found this bug instead.

@illwieckz illwieckz added the bug label Jan 13, 2020
@illwieckz illwieckz changed the title RE_GenerateTexture: endless incrementing global signed integer is asking for overflow RE_GenerateTexture: endlessly incrementing global signed integer is asking for overflow Jan 13, 2020
@illwieckz

This comment has been minimized.

Copy link
Member Author

@illwieckz illwieckz commented Jan 13, 2020

This may be somewhat safe as it's only building a string, then negative values are just printed into that string:

]/imagelist rocket
 
      -w-- -h-- -mm- -type- -if---- -srgb-- -swrap- -twrap-- -name-------- 
  90:  256  512 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket-6 
  91:  256  256 no   2D     RGBA8   yes     s.clmp  t.clmp   rocket-5 
 --------- 
 196608 total texels (not including mipmaps) 
 0.75 MB total image memory 
 93 total images

It may be better to fix it in any way, and make sure there is no more libRocket texture allocated than the number of names we can produce, because maybe a random game code can ask engine to create a lot of textures in order to generate more than the total number of positive and negative values.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
1 participant
You can’t perform that action at this time.