compute_fov loads out-of-range int into TCOD_fov_algorithm_t enum (UBSan) #310

New issue

Closed

opened 2026-04-11 21:22:07 +00:00 by john · 0 comments

john commented

2026-04-11 21:22:07 +00:00

Owner

Found by: fuzz_fov target (W8)

Summary

The Python binding for Grid.compute_fov passes a raw int algorithm argument straight through to GridData::computeFOV without validating it against the TCOD_fov_algorithm_t enum range. UBSan catches the invalid enum load:

runtime error: load of value 4294967247, which is not a valid value for type 'TCOD_fov_algorithm_t'

(4294967247 is -49 reinterpreted as unsigned.)

Reproduction

Crash input preserved at:

tests/fuzz/crashes/fov-crash-d5da064d802ae2b5691c520907cd692d04de8bb2

Root Cause

Invalid enum cast happens at src/GridData.cpp:136
The unchecked value originates at the binding layer src/UIGridPyMethods.cpp:112

Suggested Fix

Validate the int at the binding layer before converting to the enum. Reject (or clamp to a default) anything outside TCOD_BASIC..TCOD_SYMMETRIC_SHADOWCAST, raising a ValueError to Python for invalid input.

Fail-early principle: validation belongs at the boundary between Python and the C++ engine, not deep in the TCOD call path.

**Found by:** `fuzz_fov` target (W8) ## Summary The Python binding for `Grid.compute_fov` passes a raw int `algorithm` argument straight through to `GridData::computeFOV` without validating it against the `TCOD_fov_algorithm_t` enum range. UBSan catches the invalid enum load: ``` runtime error: load of value 4294967247, which is not a valid value for type 'TCOD_fov_algorithm_t' ``` (`4294967247` is `-49` reinterpreted as unsigned.) ## Reproduction Crash input preserved at: ``` tests/fuzz/crashes/fov-crash-d5da064d802ae2b5691c520907cd692d04de8bb2 ``` ## Root Cause - Invalid enum cast happens at `src/GridData.cpp:136` - The unchecked value originates at the binding layer `src/UIGridPyMethods.cpp:112` ## Suggested Fix Validate the int at the binding layer before converting to the enum. Reject (or clamp to a default) anything outside `TCOD_BASIC`..`TCOD_SYMMETRIC_SHADOWCAST`, raising a `ValueError` to Python for invalid input. ## Related Fail-early principle: validation belongs at the boundary between Python and the C++ engine, not deep in the TCOD call path.