From owner-svn-ports-all@freebsd.org Tue Dec 22 00:10:55 2015 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6890BA4E9F2; Tue, 22 Dec 2015 00:10:55 +0000 (UTC) (envelope-from amdmi3@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 45CD31634; Tue, 22 Dec 2015 00:10:55 +0000 (UTC) (envelope-from amdmi3@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id tBM0As2L060574; Tue, 22 Dec 2015 00:10:54 GMT (envelope-from amdmi3@FreeBSD.org) Received: (from amdmi3@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id tBM0Aswu060571; Tue, 22 Dec 2015 00:10:54 GMT (envelope-from amdmi3@FreeBSD.org) Message-Id: <201512220010.tBM0Aswu060571@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: amdmi3 set sender to amdmi3@FreeBSD.org using -f From: Dmitry Marakasov Date: Tue, 22 Dec 2015 00:10:54 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r404198 - in head/games/dhewm3: . files X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Dec 2015 00:10:55 -0000 Author: amdmi3 Date: Tue Dec 22 00:10:54 2015 New Revision: 404198 URL: https://svnweb.freebsd.org/changeset/ports/404198 Log: - Fix several crashes in Restoration of Evil - Silence mkdirs Added: head/games/dhewm3/files/patch-roe-bfh-crash (contents, props changed) head/games/dhewm3/files/patch-roe-last-level-load-crash (contents, props changed) Modified: head/games/dhewm3/Makefile Modified: head/games/dhewm3/Makefile ============================================================================== --- head/games/dhewm3/Makefile Mon Dec 21 23:22:35 2015 (r404197) +++ head/games/dhewm3/Makefile Tue Dec 22 00:10:54 2015 (r404198) @@ -3,6 +3,7 @@ PORTNAME= dhewm3 PORTVERSION= 1.4.0 +PORTREVISION= 1 CATEGORIES= games MAINTAINER= amdmi3@FreeBSD.org @@ -45,13 +46,13 @@ post-patch-OPTIMIZED_CFLAGS-off: @${REINPLACE_CMD} -e 's|-O3 -ffast-math -fno-unsafe-math-optimizations -fomit-frame-pointer||' ${WRKSRC}/CMakeLists.txt post-install: - ${MKDIR} ${STAGEDIR}${DATADIR}/base - ${MKDIR} ${STAGEDIR}${DATADIR}/d3xp + @${MKDIR} ${STAGEDIR}${DATADIR}/base + @${MKDIR} ${STAGEDIR}${DATADIR}/d3xp ${INSTALL_DATA} ${WRKSRC}/sys/linux/setup/image/doom3.png \ ${STAGEDIR}${PREFIX}/share/pixmaps/ post-install-DOCS-on: - ${MKDIR} ${STAGEDIR}${DOCSDIR} + @${MKDIR} ${STAGEDIR}${DOCSDIR} ${INSTALL_DATA} ${WRKSRC}/../README.md ${STAGEDIR}${DOCSDIR}/ .include Added: head/games/dhewm3/files/patch-roe-bfh-crash ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/games/dhewm3/files/patch-roe-bfh-crash Tue Dec 22 00:10:54 2015 (r404198) @@ -0,0 +1,52 @@ +commit b03fc9271aa5c4aaf4e90a940c78d004e2962148 +Author: Daniel Gibson +Date: Sun Dec 13 03:06:52 2015 +0100 + + Fix crash by assert in last RoE level (and maybe elsewhere) + + The assertion in idBounds::operator-(const idBounds&) was triggered + from idWeapon::Event_LaunchProjectiles() (ownerBounds - projBounds) + It only happened when using the BFG. + So I added a check to make sure calling operator- is legal. + + I guess this also caused #122 + +diff --git neo/d3xp/Weapon.cpp neo/d3xp/Weapon.cpp +index 2101381..30f8882 100644 +--- d3xp/Weapon.cpp ++++ d3xp/Weapon.cpp +@@ -3446,7 +3446,14 @@ void idWeapon::Event_LaunchProjectiles( int num_projectiles, float spread, float + // make sure the projectile starts inside the bounding box of the owner + if ( i == 0 ) { + muzzle_pos = muzzleOrigin + playerViewAxis[ 0 ] * 2.0f; +- if ( ( ownerBounds - projBounds).RayIntersection( muzzle_pos, playerViewAxis[0], distance ) ) { ++ ++ // DG: sometimes the assertion in idBounds::operator-(const idBounds&) triggers ++ // (would get bounding box with negative volume) ++ // => check that before doing ownerBounds - projBounds (equivalent to the check in the assertion) ++ idVec3 obDiff = ownerBounds[1] - ownerBounds[0]; ++ idVec3 pbDiff = projBounds[1] - projBounds[0]; ++ bool boundsSubLegal = obDiff.x > pbDiff.x && obDiff.y > pbDiff.y && obDiff.z > pbDiff.z; ++ if ( boundsSubLegal && ( ownerBounds - projBounds ).RayIntersection( muzzle_pos, playerViewAxis[0], distance ) ) { + start = muzzle_pos + distance * playerViewAxis[0]; + } else { + start = ownerBounds.GetCenter(); +diff --git neo/game/Weapon.cpp neo/game/Weapon.cpp +index d889c68..a381ae2 100644 +--- game/Weapon.cpp ++++ game/Weapon.cpp +@@ -2941,7 +2941,13 @@ void idWeapon::Event_LaunchProjectiles( int num_projectiles, float spread, float + // make sure the projectile starts inside the bounding box of the owner + if ( i == 0 ) { + muzzle_pos = muzzleOrigin + playerViewAxis[ 0 ] * 2.0f; +- if ( ( ownerBounds - projBounds).RayIntersection( muzzle_pos, playerViewAxis[0], distance ) ) { ++ // DG: sometimes the assertion in idBounds::operator-(const idBounds&) triggers ++ // (would get bounding box with negative volume) ++ // => check that before doing ownerBounds - projBounds (equivalent to the check in the assertion) ++ idVec3 obDiff = ownerBounds[1] - ownerBounds[0]; ++ idVec3 pbDiff = projBounds[1] - projBounds[0]; ++ bool boundsSubLegal = obDiff.x > pbDiff.x && obDiff.y > pbDiff.y && obDiff.z > pbDiff.z; ++ if ( boundsSubLegal && ( ownerBounds - projBounds ).RayIntersection( muzzle_pos, playerViewAxis[0], distance ) ) { + start = muzzle_pos + distance * playerViewAxis[0]; + } else { + start = ownerBounds.GetCenter(); Added: head/games/dhewm3/files/patch-roe-last-level-load-crash ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/games/dhewm3/files/patch-roe-last-level-load-crash Tue Dec 22 00:10:54 2015 (r404198) @@ -0,0 +1,51 @@ +commit 9950a5721f98eaffc6d8360c6d52ea9bcc0afb9c +Author: Daniel Gibson +Date: Thu Dec 17 18:07:35 2015 +0100 + + Fix heap corruption when loading (broken?) .ma models + + On FreeBSD, the game used to crash when loading the last level of RoE + (d3xp), while loading models/david/hell_h7.ma. + The problem could be reproduced on Linux whith #define USE_LIBC_MALLOC 1 + and clang's AddressSanitizer. + Turns out that this file specifies a vertex transform for a non-existent + vertex (index 31, while we only have 0-30) and thus the bounds of + pMesh->vertexes[] are violated. + I added a check to ensure the index is within the bounds and a Warning + if it isn't. + It should work now. If however it turns out that more files have this + problem, maybe .ma is parsed incorrectly and we need a differently fix. + + (Should) fix #138 + +diff --git neo/renderer/Model_ma.cpp neo/renderer/Model_ma.cpp +index e31ca40..1cd672a 100644 +--- renderer/Model_ma.cpp ++++ renderer/Model_ma.cpp +@@ -203,7 +203,7 @@ bool MA_ParseVertex(idParser& parser, maAttribHeader_t* header) { + + //Allocate enough space for all the verts if this is the first attribute for verticies + if(!pMesh->vertexes) { +- pMesh->numVertexes = header->size; ++ pMesh->numVertexes = header->size; // XXX: +1? + pMesh->vertexes = (idVec3 *)Mem_Alloc( sizeof( idVec3 ) * pMesh->numVertexes ); + } + +@@ -692,7 +692,16 @@ void MA_ParseMesh(idParser& parser) { + + //Now apply the pt transformations + for(int i = 0; i < pMesh->numVertTransforms; i++) { +- pMesh->vertexes[(int)pMesh->vertTransforms[i].w] += pMesh->vertTransforms[i].ToVec3(); ++ int idx = (int)pMesh->vertTransforms[i].w; ++ if(idx < 0 || idx >= pMesh->numVertexes) ++ { ++ // this happens with d3xp/models/david/hell_h7.ma in the d3xp hell level ++ // TODO: if it happens for other models, too, maybe it's intended and the .ma parsing is broken ++ common->Warning( "Model %s tried to set an out-of-bounds vertex transform (%d, but max vert. index is %d)!", ++ parser.GetFileName(), idx, pMesh->numVertexes-1 ); ++ continue; ++ } ++ pMesh->vertexes[idx] += pMesh->vertTransforms[i].ToVec3(); + } + + MA_VERBOSE((va("MESH %s - parent %s\n", header.name, header.parent)));