[3.x] Fix physics platform behaviour regression #97316
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Lifetime checks for stored
RIDs
for collision objects assumed they had validobject_ids
. It turns out that some are not derived fromObject
and thus checkingObjectDB
returns false for some validRIDs
. To account for this we only perform lifetime checks on validobject_ids
.Fixes #97293 (for 3.x)
3.x version of #97315
Discussion
Although the original MRP in #74732 had valid object ids, it turns out that physics also stores
RIDs
for objects which are not inObjectDB
. This means we can't lifetime check them withObjectDB
, and the same vulnerability exists for accessing danglingRIDs
that caused the original issue.This should ideally be closed as the current design is unsafe, although there are no reports afaik of this occurring in the wild (although such errors may not result in crash and may only be seen in e.g. asan build).
Making completely safe in this situation is out of scope for this PR, and as stated in the original issue, would involve e.g.