mojira.dev
MC-311522

The source buffer overrun check in `FrontendCommandEncoder#writeToTexture` uses integer arithmetic

https://mcsrc.dev/2/26.3-snapshot-10/com/mojang/renderpearl/frontend/FrontendCommandEncoder#L474

if (width * height * destination.getFormat().blockSize() > source.remaining()) {

All three operands are int, so the product overflows for large textures and the comparison silently passes. At 16384x16384 in an 8 byte format the product is roughly 2.1e9 and wraps negative, defeating the check entirely. copyBufferToTexture, ten lines below, performs the equivalent computation correctly:

https://mcsrc.dev/2/26.3-snapshot-10/com/mojang/renderpearl/frontend/FrontendCommandEncoder#L560

Casting the first operand to long makes the two checks agree. The sizes involved exceed what most drivers report through maxTextureSize, so this is unlikely to be reachable today, but the inconsistency between two adjacent checks is worth removing.

Comments 1

Lolo

rabrandt

Community Consensus

Platform G

Normal

Crash

26.3 Snapshot 10

Retrieved