Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix silent overflows when calling array functions #74676

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

RedworkDE
Copy link
Member

Fixes arguments to Array functions being silently truncated to 32-bit length potentially causing unexpected results.

In the slice functions the arguments are clamped instead of causing an error, because that is the behavior of the called method for these arguments.


IMO the only case that is likely to be hit is with the resize method, e.g. [].resize((1<<32) + 5) which currently returns OK, but only allocating a 5 element array instead of a 100GB big one, likely causing all kinds of followup issues.

var arr = []
print(error_string(arr.resize((1 << 32) + 5)))
print(arr.size())

Before: (everything appears to work, the array just wasn't resized as expected)

OK
5

After: (An error is printed, an error code returned, and the array is not changed)

ERROR: Condition "p_size != int(p_size)" is true. Returning: ERR_INVALID_PARAMETER
   at: resize (core/variant/variant_call.cpp:1094)
Invalid parameter
0

@akien-mga akien-mga modified the milestones: 4.1, 4.2 Jun 19, 2023
@YuriSizov YuriSizov modified the milestones: 4.2, 4.3 Oct 30, 2023
@YuriSizov
Copy link
Contributor

This is probably something we should consider sooner rather than later, but this close to 4.2 it would be too risky to do such core changes.

@KoBeWi KoBeWi modified the milestones: 4.3, 4.4 Aug 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants