John McCardle
79df32317b
#321 was an ASan heap-buffer-overflow in view_array_insert (fov_permissive2.c:97) reached via ColorLayer.draw_fov -> GridData::computeFOV -> TCOD_map_compute_fov_permissive2, surfaced by the #312 fuzz_fov campaign. The "bad-free in ~GridData" in the issue title is the downstream symptom of this active_views buffer overflow. The bump pulls in four upstream FOV commits: - off-by-one in view_array_insert overflowing active_views <- root cause - undersized bumps buffer overflow on tiny permissive maps - MRPAS obstacle buffer overflow / malloc(0) on small maps - regression tests for FOV Verified by A/B replay of the fuzz_fov crash corpus under clang-18 ASan, same build config (clang-18, -DLIBTCOD_SDL3=OFF, identical sanitizer flags) with only the submodule commit differing: pre-fix (8835239): fov-crash-5f34f68e and fov-crash-a451db54 abort with heap-buffer-overflow in view_array_insert inside GridData::computeFOV post-fix (79abc66): all crash inputs clean; 45s / 21,952-run fov fuzz smoke clean, no new crashes Note: __lib/libtcod.so (gitignored, the shipped desktop lib) must be rebuilt from this submodule commit for release binaries to carry the fix. Also updates ROADMAP: #321 moved to Recently Shipped; open-issue count refreshed to the post-#312 tracker state. closes #321 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TvvE6TB2cScBVbeap2btHw |
||
|---|---|---|
| .. | ||
| cpython@931e6b4e3f | ||
| imgui@c6e0284ac5 | ||
| imgui-sfml@4a67e85f7e | ||
| json@21b53746c9 | ||
| libtcod-headless@79abc66578 | ||
| RapidXML@3a42082084 | ||
| SFML@69ea0cd863 | ||