From 3df9d187a32c7d1d500812b295e01c8f14eb50de Mon Sep 17 00:00:00 2001
From: Haoyu Qiu <timothyqiu32@gmail.com>
Date: Wed, 11 Dec 2019 08:57:57 +0800
Subject: Fixes crash when using Mesh::create_outline and
 Mesh::create_convex_shape

Adds a size check to the array returned by `surface_get_arrays`.

During debugging, `create_outline` also crashes when the indices size is
one (not a multiple of three). For now, just reports the error and fail
the function.
---
 scene/resources/mesh.cpp | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'scene/resources')

diff --git a/scene/resources/mesh.cpp b/scene/resources/mesh.cpp
index 13721191c0..0599920303 100644
--- a/scene/resources/mesh.cpp
+++ b/scene/resources/mesh.cpp
@@ -75,6 +75,7 @@ Ref<TriangleMesh> Mesh::generate_triangle_mesh() const {
 			continue;
 
 		Array a = surface_get_arrays(i);
+		ERR_FAIL_COND_V(a.empty(), Ref<TriangleMesh>());
 
 		int vc = surface_get_array_len(i);
 		PoolVector<Vector3> vertices = a[ARRAY_VERTEX];
@@ -234,6 +235,7 @@ Ref<Shape> Mesh::create_convex_shape() const {
 	for (int i = 0; i < get_surface_count(); i++) {
 
 		Array a = surface_get_arrays(i);
+		ERR_FAIL_COND_V(a.empty(), Ref<ConvexPolygonShape>());
 		PoolVector<Vector3> v = a[ARRAY_VERTEX];
 		vertices.append_array(v);
 	}
@@ -273,6 +275,7 @@ Ref<Mesh> Mesh::create_outline(float p_margin) const {
 			continue;
 
 		Array a = surface_get_arrays(i);
+		ERR_FAIL_COND_V(a.empty(), Ref<ArrayMesh>());
 
 		if (i == 0) {
 			arrays = a;
@@ -378,6 +381,7 @@ Ref<Mesh> Mesh::create_outline(float p_margin) const {
 		PoolVector<Vector3>::Write r = vertices.write();
 
 		if (indices.size()) {
+			ERR_FAIL_COND_V(indices.size() % 3 != 0, Ref<ArrayMesh>());
 			vc = indices.size();
 			ir = indices.write();
 			has_indices = true;
-- 
cgit v1.2.3