From a7d62d1af983e156ffe3282885f41720e15db4d5 Mon Sep 17 00:00:00 2001 From: Kelsi Date: Wed, 6 May 2026 05:44:37 -0700 Subject: [PATCH] fix(woc): reject corrupted triCount + clamp out-of-range tile coords Header sanity bounds for WOC matching the WOM/WoB ones. A whole-tile collision mesh maxes at ~32K terrain tris + a few thousand building overlay tris; triCount > 2M is corrupted and would OOM. Tile coords are 0..63 in WoW; clamp to 32 with warning when bogus. --- src/pipeline/wowee_collision.cpp | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/pipeline/wowee_collision.cpp b/src/pipeline/wowee_collision.cpp index ea172576..0b278f81 100644 --- a/src/pipeline/wowee_collision.cpp +++ b/src/pipeline/wowee_collision.cpp @@ -195,6 +195,20 @@ WoweeCollision WoweeCollisionBuilder::load(const std::string& path) { f.read(reinterpret_cast(&col.tileY), 4); f.read(reinterpret_cast(&col.bounds.min), 12); f.read(reinterpret_cast(&col.bounds.max), 12); + // A whole-tile collision mesh tops out at ~256*128 = 32K terrain triangles + // plus building overlays. >2M is corrupted and would OOM us. + if (triCount > 2'000'000) { + LOG_ERROR("WOC triCount rejected (", triCount, "): ", path); + return WoweeCollision{}; + } + // Tile coords are valid 0..63 in WoW; cap higher values that suggest + // a corrupted file rather than letting them propagate. + if (col.tileX > 63 || col.tileY > 63) { + LOG_WARNING("WOC tile coord out of range (", col.tileX, ",", col.tileY, + ") — clamping"); + if (col.tileX > 63) col.tileX = 32; + if (col.tileY > 63) col.tileY = 32; + } col.triangles.reserve(triCount); auto fixVec = [](glm::vec3& v) {