Description

From licensee:

The issue here starts in FVoxelizeMeshMerging::ProxyLOD() where the FlattenMaterial created using FMaterialUtilities::CreateFlattenMaterialWithSettings() returns an empty struct. I don't see any validations done in subsequent code which checks for the FlattenMaterial struct being valid.

Later in the same function, provided the simplified mesh can GenerateUVs, we get bProxyGenerationSuccess being left as true, which then leads to calling a ProcessComplete delegate leading to pipelining this set of data in FProxyGenerationProcessor::ProxyGenerationComplete().

This data is later used in FMaterialUtilities::CreateFlattenMaterialInstance() where the FlattenMaterial struct, which is still essentially empty, is used without any validations. This leads to a crash with unsafe access where an Empty array's zeroth element is directly getting accessed.

Steps to Reproduce

Create a World Partitioned map with an HLOD Layer whose Layer Type is set to Simplified. Under ProxySettings MaterialSettings TextureSizingType, set it to TextureSizingType_AutomaticFromMeshDrawDistance. Ensure you have meshes in the world where the simplified mesh CAN generate UVs (as in the attached project).

 

Callstack
[Inline Frame] UnrealEditor-MaterialUtilities.dll!TArray<FColor,TSizedDefaultAllocator<32>>::RangeCheck(int Index) Line 691	C++
[Inline Frame] UnrealEditor-MaterialUtilities.dll!TArray<FColor,TSizedDefaultAllocator<32>>::operator[](int) Line 759	C++
UnrealEditor-MaterialUtilities.dll!FMaterialUtilities::CreateFlattenMaterialInstance::__l2::<lambda>(EFlattenMaterialProperties FlattenProperty) Line 365	C++
UnrealEditor-MaterialUtilities.dll!FMaterialUtilities::CreateFlattenMaterialInstance(UPackage * InOuter, const FMaterialProxySettings & InMaterialProxySettings, UMaterialInterface * InBaseMaterial, const FFlattenMaterial & FlattenMaterial, const FString & AssetBasePath, const FString & AssetBaseName, TArray<UObject *,TSizedDefaultAllocator<32>> & OutAssetsToSync, FMaterialUpdateContext * MaterialUpdateContext) Line 393	C++
UnrealEditor-MeshMergeUtilities.dll!FProxyGenerationProcessor::ProcessJob(const FGuid & JobGuid, FProxyGenerationProcessor::FProxyGenerationData * Data) Line 163	C++
UnrealEditor-MeshMergeUtilities.dll!FProxyGenerationProcessor::Tick(float DeltaTime) Line 81	C++
UnrealEditor-MeshMergeUtilities.dll!FMeshMergeUtilities::CreateProxyMesh(const TArray<UStaticMeshComponent *,TSizedDefaultAllocator<32>> & InComponentsToMerge, const FMeshProxySettings & InMeshProxySettings, UMaterialInterface * InBaseMaterial, UPackage * InOuter, const FString & InProxyBasePackageName, const FGuid InGuid, const TDelegate<void __cdecl(FGuid,TArray<UObject *,TSizedDefaultAllocator<32>> &),FDefaultDelegateUserPolicy> & InProxyCreatedDelegate, const bool bAllowAsync, const float ScreenSize) Line 1933	C++
UnrealEditor-WorldPartitionHLODUtilities.dll!UHLODBuilderMeshSimplify::Build(const FHLODBuildContext & InHLODBuildContext, const TArray<UActorComponent *,TSizedDefaultAllocator<32>> & InSourceComponents) Line 107	C++
UnrealEditor-Engine.dll!UHLODBuilder::Build(const FHLODBuildContext & InHLODBuildContext, const TArray<AActor *,TSizedDefaultAllocator<32>> & InSourceActors) Line 167	C++
UnrealEditor-WorldPartitionHLODUtilities.dll!FWorldPartitionHLODUtilities::BuildHLOD(AWorldPartitionHLOD * InHLODActor) Line 377	C++
UnrealEditor-Engine.dll!AWorldPartitionHLOD::BuildHLOD(bool bForceBuild) Line 197	C++
UnrealEditor-UnrealEd.dll!UWorldPartitionHLODsBuilder::BuildHLODActors() Line 479	C++
UnrealEditor-UnrealEd.dll!UWorldPartitionHLODsBuilder::RunInternal(UWorld * World, const FCellInfo & InCellInfo, FPackageSourceControlHelper & PackageHelper) Line 305	C++
UnrealEditor-UnrealEd.dll!UWorldPartitionBuilder::Run(UWorld * World, FPackageSourceControlHelper & PackageHelper) Line 277	C++
UnrealEditor-UnrealEd.dll!UWorldPartitionBuilder::RunBuilder(UWorld * World) Line 87	C++
UnrealEditor-UnrealEd.dll!UWorldPartitionBuilderCommandlet::Main(const FString & Params) Line 101	C++
UnrealEditor.exe!FEngineLoop::PreInitPostStartupScreen(const wchar_t * CmdLine) Line 3659	C++
[Inline Frame] UnrealEditor.exe!FEngineLoop::PreInit(const wchar_t *) Line 3883	C++
[Inline Frame] UnrealEditor.exe!EnginePreInit(const wchar_t *) Line 42	C++
UnrealEditor.exe!GuardedMain(const wchar_t * CmdLine) Line 137	C++
UnrealEditor.exe!LaunchWindowsStartup(HINSTANCE__ * hInInstance, HINSTANCE__ * hPrevInstance, char * __formal, int nCmdShow, const wchar_t * CmdLine) Line 272	C++
UnrealEditor.exe!WinMain(HINSTANCE__ * hInInstance, HINSTANCE__ * hPrevInstance, char * pCmdLine, int nCmdShow) Line 330	C++

Have Comments or More Details?

There's no existing public thread on this issue, so head over to Questions & Answers just mention UE-161274 in the post.

0
Login to Vote

Fixed
Fix Commit22088704
Main Commit22088941
Release Commit22088704
CreatedAug 17, 2022
ResolvedSep 20, 2022
UpdatedOct 20, 2022
View Jira Issue