Godot 4.x binary resource loader heap write fix merged
Original title: Re: Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader
Pull request 124699 rejects negative or oversized string lengths in the binary resource loader's string readers.
Tomasz Kaye reported on October 23 that the upstream fix for a heap out-of-bounds write in Godot 4.x is merged. The bug is triggered by a negative string length in the binary resource loader. Pull request 124699 rejects negative lengths and lengths past the remaining file size in get_unicode_string and get_ustring, and returns early on a zero length in get_ustring.
Unconfirmed: A shipped fixed version and any exploitation are not stated in the truncated note.
- The fix is godotengine/godot pull request 124699.
- Checks apply in get_unicode_string and get_ustring.
- Zero-length strings return early in get_ustring.
Impact: Heap out-of-bounds write via a negative string length
| Product | Affected |
|---|---|
| Godot Engine Godot | 4.x |
- 1.Apply the upstream fix merged in pull request 124699.
- Vendors
- Godot Engine
- Products
- Godot
From the original article
Posted by Tomasz Kaye on Oct 23 Follow-up: the fix for this issue has been merged upstream. https://github. com/godotengine/godot/pull/124699 The patch rejects negative lengths, and lengths beyond the remaining file size, in ResourceLoaderBinary::get_unicode_string and get_ustring, and returns early on a zero length in get_ustring....
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.