Description

User reports of stack overflow happening in canRemoveVertex in DetourTileCacheBuilder.cpp if a poly has more than 16 vertices. The array for edges is a fixed array and is written to without checking if the bounds are valid. User workaround is to increase size of MAX_REM_EDGES and a check inside for loop that iterates through the edges touching the removed vertex.

Steps to Reproduce

Unable to locally reproduce.

Have Comments or More Details?

There's no existing public thread on this issue, so head over to Questions & Answers just mention UE-196823 in the post.

0
Login to Vote

Fixed
ComponentUE - AI - Navigation
Affects Versions5.2.1
Target Fix5.4
Fix Commit29960982
CreatedSep 28, 2023
ResolvedDec 8, 2023
UpdatedApr 4, 2024
View Jira Issue