Merge pull request #106654 from jamie-pate/fix_106647

Repiteo · Repiteo · commit 4a44078451d7 · 2025-05-21T09:06:28.000-05:00
Fix Heap buffer overflow in Animation::_find()
diff --git a/scene/resources/animation.cpp b/scene/resources/animation.cpp
@@ -2441,7 +2441,7 @@ int Animation::_find(const Vector<K> &p_keys, double p_time, bool p_backward, bo
 		}
 	}
 
-	if (p_limit) {
+	if (p_limit && middle > -1 && middle < len) {
 		double diff = length - keys[middle].time;
 		if ((std::signbit(keys[middle].time) && !Math::is_zero_approx(keys[middle].time)) || (std::signbit(diff) && !Math::is_zero_approx(diff))) {
 			ERR_PRINT_ONCE_ED("Found the key outside the animation range. Consider using the clean-up option in AnimationTrackEditor to fix it.");

Original file line number	Diff line number	Diff line change
`@@ -2441,7 +2441,7 @@ int Animation::_find(const Vector<K> &p_keys, double p_time, bool p_backward, bo`
`2441`	`2441`	`}`
`2442`	`2442`	`}`
`2443`	`2443`
`2444`		`- if (p_limit) {`
	`2444`	`+ if (p_limit && middle > -1 && middle < len) {`
`2445`	`2445`	`double diff = length - keys[middle].time;`
`2446`	`2446`	`if ((std::signbit(keys[middle].time) && !Math::is_zero_approx(keys[middle].time)) \|\| (std::signbit(diff) && !Math::is_zero_approx(diff))) {`
`2447`	`2447`	`ERR_PRINT_ONCE_ED("Found the key outside the animation range. Consider using the clean-up option in AnimationTrackEditor to fix it.");`