From 9e4d80e08e35279af5f95915f64b980c0f9c7ba3 Mon Sep 17 00:00:00 2001 From: David Snopek Date: Fri, 10 Feb 2023 19:33:18 -0600 Subject: [PATCH] Fix byte packing (and buffer overrun) in godot_webxr_get_bounds_geometry() --- modules/webxr/native/library_godot_webxr.js | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/modules/webxr/native/library_godot_webxr.js b/modules/webxr/native/library_godot_webxr.js index 1c00ebebb47..5c01d88a307 100644 --- a/modules/webxr/native/library_godot_webxr.js +++ b/modules/webxr/native/library_godot_webxr.js @@ -584,12 +584,11 @@ const GodotWebXR = { } const buf = GodotRuntime.malloc(point_count * 3 * 4); - GodotRuntime.setHeapValue(buf, point_count, 'i32'); for (let i = 0; i < point_count; i++) { const point = GodotWebXR.space.boundsGeometry[i]; - GodotRuntime.setHeapValue(buf + ((i * 3) + 1) * 4, point.x, 'float'); - GodotRuntime.setHeapValue(buf + ((i * 3) + 2) * 4, point.y, 'float'); - GodotRuntime.setHeapValue(buf + ((i * 3) + 3) * 4, point.z, 'float'); + GodotRuntime.setHeapValue(buf + ((i * 3) + 0) * 4, point.x, 'float'); + GodotRuntime.setHeapValue(buf + ((i * 3) + 1) * 4, point.y, 'float'); + GodotRuntime.setHeapValue(buf + ((i * 3) + 2) * 4, point.z, 'float'); } GodotRuntime.setHeapValue(r_points, buf, 'i32');