Revision control
Copy as Markdown
From 80bbcabcba0ea25c9d0c8857060cb870f60e5e54 Mon Sep 17 00:00:00 2001
From: Jonas Karlsson <jonas.karlsson@qt.io>
Date: Thu, 6 Aug 2026 16:25:32 +0200
Subject: [PATCH] PhysX: Fix stack-buffer-overflow in CCD sweep
CCDSweep() loaded lastTm0.p/lastTm1.p with an aligned 16-byte SIMD
load (V3LoadA). PxVec3 p is the last member of the 28-byte
PxTransform, so this load always reads 4 bytes past the end of the
struct. The same function already uses the safe unaligned load
(V3LoadU) for transform0.p/transform1.p a few lines below, so this
was an inconsistency in the vendored code.
This went unnoticed under ASan until CCD started running
unconditionally for every scene and a sphere-vs-box CCD sweep test
was added, both of which first exercise this code path.
Pick-to: 6.12 6.11 6.8
Change-Id: I8c0e6e3e2ff2be2c826c48f0b0dbd5d1f26cbeb1
---
.../PhysX/source/geomutils/src/ccd/GuCCDSweepPrimitives.cpp | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/3rdparty/PhysX/source/geomutils/src/ccd/GuCCDSweepPrimitives.cpp b/src/3rdparty/PhysX/source/geomutils/src/ccd/GuCCDSweepPrimitives.cpp
index f5d26ad0..7d9aa479 100644
--- a/src/3rdparty/PhysX/source/geomutils/src/ccd/GuCCDSweepPrimitives.cpp
+++ b/src/3rdparty/PhysX/source/geomutils/src/ccd/GuCCDSweepPrimitives.cpp
@@ -67,10 +67,10 @@ static PxReal CCDSweep(ConvexA& a, ConvexB& b, const PxTransform& transform0, c
const Vec3V zero = V3Zero();
const QuatV q0 = QuatVLoadA(&transform0.q.x);
- const Vec3V p0 = V3LoadA(&lastTm0.p.x);
+ const Vec3V p0 = V3LoadU(&lastTm0.p.x);
const QuatV q1 = QuatVLoadA(&transform1.q.x);
- const Vec3V p1 = V3LoadA(&lastTm1.p.x);
+ const Vec3V p1 = V3LoadU(&lastTm1.p.x);
const PsTransformV tr0(p0, q0);
const PsTransformV tr1(p1, q1);
--
2.55.0