From 4e539028fb60cc84c0648a2eb3f9da8086ef26bb Mon Sep 17 00:00:00 2001 From: A Thousand Ships <96648715+AThousandShips@users.noreply.github.com> Date: Sat, 19 Aug 2023 16:01:21 +0200 Subject: [PATCH] Fix memory access error for `MultiMesh` with GLES3 Buffer was incorrectly assigned when invalid data was provided (cherry picked from commit 6cb28e481f72d6fa1b2d06ff1e0c8664dcbd22ca) --- drivers/gles3/storage/mesh_storage.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/gles3/storage/mesh_storage.cpp b/drivers/gles3/storage/mesh_storage.cpp index f3be6f509e2..8bb47f76adb 100644 --- a/drivers/gles3/storage/mesh_storage.cpp +++ b/drivers/gles3/storage/mesh_storage.cpp @@ -1685,14 +1685,16 @@ void MeshStorage::multimesh_set_buffer(RID p_multimesh, const Vector &p_b // Color and custom need to be packed so copy buffer to data_cache and pack. _multimesh_make_local(multimesh); - multimesh->data_cache = p_buffer; - float *w = multimesh->data_cache.ptrw(); uint32_t old_stride = multimesh->xform_format == RS::MULTIMESH_TRANSFORM_2D ? 8 : 12; old_stride += multimesh->uses_colors ? 4 : 0; old_stride += multimesh->uses_custom_data ? 4 : 0; ERR_FAIL_COND(p_buffer.size() != (multimesh->instances * (int)old_stride)); + multimesh->data_cache = p_buffer; + + float *w = multimesh->data_cache.ptrw(); + for (int i = 0; i < multimesh->instances; i++) { { float *dataptr = w + i * old_stride;