From 364f11304f46d1ca10a177c9b4f8f3f14dad4ec1 Mon Sep 17 00:00:00 2001 From: Jacob Ledbetter Date: Mon, 24 Aug 2026 12:51:40 -0600 Subject: [PATCH] fix(htree): Reject UINT32_MAX pivot counts on pre-3.0 W3D loads Prevent the synthetic-root increment from wrapping to zero so load does not skip allocation and then write Pivot[0]. Co-authored-by: Cursor --- Core/Libraries/Source/WWVegas/WW3D2/htree.cpp | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Core/Libraries/Source/WWVegas/WW3D2/htree.cpp b/Core/Libraries/Source/WWVegas/WW3D2/htree.cpp index fc64894f36b..34439152ede 100644 --- a/Core/Libraries/Source/WWVegas/WW3D2/htree.cpp +++ b/Core/Libraries/Source/WWVegas/WW3D2/htree.cpp @@ -200,6 +200,10 @@ int HTreeClass::Load_W3D(ChunkLoadClass & cload) */ bool pre30 = false; if (header.Version < W3D_MAKE_VERSION(3,0)) { + // TheSuperHackers @fix CryoTheRenegade 24/08/2026 Reject UINT32_MAX pivot counts so the pre-3.0 increment cannot wrap to zero, skip allocation, and then write Pivot[0]. + if (header.NumPivots == 0xffffffffu) { + return LOAD_ERROR; + } header.NumPivots ++; pre30 = true; } @@ -267,6 +271,9 @@ bool HTreeClass::read_pivots(ChunkLoadClass & cload,bool pre30) ** this so we just put one in. */ if (pre30) { + if (Pivot == nullptr || NumPivots < 1) { + return false; + } Pivot[0].Index = 0; Pivot[0].Parent = nullptr; Pivot[0].BaseTransform.Make_Identity();