btBulletWorldImporter::createStridingMeshInterfaceData crash

[GoogleCodeExporter]

I got a crash while loading some models with the world-importer. The debugger 
hit line 298 in btBulletWorldImporter.cpp (revision 2446). It seems like the 
code in that line and the one before should really be using 
curNewPart->m_numTriangles instead of numIndices. At least that fixes my crash!

Original issue reported on code.google.com by marius.elvert@gmail.com on 30 Oct 2011 at 1:42

[GoogleCodeExporter]

This doesn't seem right. Bullet always serializes 3 indices per triangle, so on 
loading you need to allocate numIndices = 3*numTriangles.

Did you make any modifications in the serialization code?

Original comment by erwin.coumans on 15 Nov 2011 at 1:28

[GoogleCodeExporter]

No, I didn't modify any code.

That specific case in the code, as it is, allocates 9 indices per triangle 
because it allocates btShortIntIndexTripletData instances, which, I think, 
already represent triplets.

This causes an out-of-bound read access, which only gives me some trouble when 
I'm starting the code outside of a debugger environment (which is odd, but I 
guess windows has more security "out in the wild"). I attached the debugger 
when the program halted because of the crash.

Original comment by marius.elvert@gmail.com on 15 Nov 2011 at 12:59

[GoogleCodeExporter]

You are right, the triplet case is wrong here

http://code.google.com/p/bullet/source/browse/trunk/Extras/Serialize/BulletWorld
Importer/btBulletWorldImporter.cpp?r=2446#295

I'll fix it soon, thanks for the report!

Original comment by erwin.coumans on 15 Nov 2011 at 2:30

[GoogleCodeExporter]

Fixed in latest trunk: http://code.google.com/p/bullet/source/detail?r=2455

Thanks!

Original comment by erwin.coumans on 15 Nov 2011 at 6:41

• Changed state: Fixed