DijkstraMap pathfinding accepts out-of-bounds coords and aborts via TCOD assertion #311

New issue

Closed

opened 2026-04-11 21:22:16 +00:00 by john · 0 comments

john commented

2026-04-11 21:22:16 +00:00

Owner

Found by: fuzz_pathfinding_behavior target (W9)

Summary

DijkstraMap::stepFrom at src/UIGridPathfinding.cpp:63 does not bounds-check its x/y arguments before forwarding them to TCOD_dijkstra_path_set. Out-of-range coordinates trigger TCOD's internal assertion, which calls abort() directly from C code at libtcod/path_c.c:600. This kills the interpreter with no recoverable Python exception.

Reproduction

Crash input preserved at:

tests/fuzz/crashes/pathfinding_behavior-crash-b7ea442fd31774b9b16c8ae99c728f609c8c25d8

W9's own verification run also predicted this finding before the fuzz suite landed, so this is a known hazard we now have a concrete crasher for.

Root Cause

// src/UIGridPathfinding.cpp:63 (DijkstraMap::stepFrom)
TCOD_dijkstra_path_set(..., x, y);  // x,y unchecked

Suggested Fix

Add bounds checks in the C++ layer before calling into TCOD. Raise ValueError / IndexError from the binding layer rather than aborting the process.

The same pattern almost certainly applies to sibling methods on DijkstraMap:

distance(x, y)
getPathFrom(x, y)

Audit all DijkstraMap entry points that take coordinates and apply consistent bounds validation.

Scope

Part of ongoing memory-safety / input-validation hardening driven by the fuzz suite. Grouping all DijkstraMap coordinate validation into this one issue since the fix is a single consistent pattern across methods.

**Found by:** `fuzz_pathfinding_behavior` target (W9) ## Summary `DijkstraMap::stepFrom` at `src/UIGridPathfinding.cpp:63` does not bounds-check its `x`/`y` arguments before forwarding them to `TCOD_dijkstra_path_set`. Out-of-range coordinates trigger TCOD's internal assertion, which calls `abort()` directly from C code at `libtcod/path_c.c:600`. This kills the interpreter with no recoverable Python exception. ## Reproduction Crash input preserved at: ``` tests/fuzz/crashes/pathfinding_behavior-crash-b7ea442fd31774b9b16c8ae99c728f609c8c25d8 ``` W9's own verification run also predicted this finding before the fuzz suite landed, so this is a known hazard we now have a concrete crasher for. ## Root Cause ```cpp // src/UIGridPathfinding.cpp:63 (DijkstraMap::stepFrom) TCOD_dijkstra_path_set(..., x, y); // x,y unchecked ``` ## Suggested Fix Add bounds checks in the C++ layer before calling into TCOD. Raise `ValueError` / `IndexError` from the binding layer rather than aborting the process. The same pattern almost certainly applies to sibling methods on `DijkstraMap`: - `distance(x, y)` - `getPathFrom(x, y)` Audit all DijkstraMap entry points that take coordinates and apply consistent bounds validation. ## Scope Part of ongoing memory-safety / input-validation hardening driven by the fuzz suite. Grouping all DijkstraMap coordinate validation into this one issue since the fix is a single consistent pattern across methods.