A licensee has reported a crash that is caused by a Buffer Overread in TBitArray's operator < function. While the licensee did not provide reproduction steps, the crash is apparent from looking at the offending code:
for (uint32 i = NumWords; i != ~0u; i--)
{
if (Data0[i] != Data1[i])
{
return Data0[i] < Data1[i];
}
}
Since this will cause the first read to go outside of the array, the licensee has suggested that this be fixed by adding a -1 to NumWords on the first line.
Regression?: No
This code was present in 4.19
No steps were provided, please refer to the description
UE4Editor-Engine.dll!FSkeletalMeshLODRenderData::InitResources(bool bNeedsVertexColors, int LODIndex, TArray
& InMorphTargets) Line 325 C++
UE4Editor-Engine.dll!FSkeletalMeshRenderData::InitResources(bool bNeedsVertexColors, TArray
& InMorphTargets) Line 147 C++
UE4Editor-Engine.dll!USkeletalMesh::InvalidateRenderData() Line 1164 C++
UE4Editor-Engine.dll!USkeletalMesh::PostEditChangeProperty(FPropertyChangedEvent & PropertyChangedEvent) Line 782 C++
UE4Editor-CoreUObject.dll!UObject::PostEditChange() Line 348 C++
UE4Editor-Engine.dll!USkeletalMesh::RemoveLegacyClothingSections() Line 1350 C++
UE4Editor-Engine.dll!USkeletalMesh::PostLoad() Line 1494 C++
UE4Editor-CoreUObject.dll!UObject::ConditionalPostLoad() Line 1009 C++
UE4Editor-CoreUObject.dll!FAsyncPackage::PostLoadObjects() Line 6287 C++
UE4Editor-CoreUObject.dll!FAsyncPackage::TickAsyncPackage(bool InbUseTimeLimit, bool InbUseFullTimeLimit, float & InOutTimeLimit, FFlushTree * FlushTree) Line 5551 C++
UE4Editor-CoreUObject.dll!FAsyncLoadingThread::ProcessAsyncLoading(int & OutPackagesProcessed, bool bUseTimeLimit, bool bUseFullTimeLimit, float TimeLimit, FFlushTree * FlushTree) Line 4472 C++
UE4Editor-CoreUObject.dll!FAsyncLoadingThread::TickAsyncThread(bool bUseTimeLimit, bool bUseFullTimeLimit, float TimeLimit, bool & bDidSomething, FFlushTree * FlushTree) Line 4985 C++
UE4Editor-CoreUObject.dll!FAsyncLoadingThread::TickAsyncLoading(bool bUseTimeLimit, bool bUseFullTimeLimit, float TimeLimit, FFlushTree * FlushTree) Line 4720 C++
UE4Editor-CoreUObject.dll!FlushAsyncLoading(int PackageID) Line 6805 C++
There's no existing public thread on this issue, so head over to Questions & Answers just mention UE-63495 in the post.
| 1 |
| Component | UE - Foundation - Core |
|---|---|
| Affects Versions | 4.19, 4.20, 4.21 |
| Target Fix | 4.22 |
| Created | Aug 29, 2018 |
|---|---|
| Resolved | Aug 30, 2018 |
| Updated | Feb 12, 2019 |