godotengine / godotengine/godot-cpp

Internal: stack overwrite on _call_native_mb_ret with godot::Error return value

Open
#986 20 comments 1 reaction 0 assignees View on GitHub
bug confirmed
Dominant language
C++
Stars
2.7k
Forks
809
Avg merge
1d 3h
Merged PRs (30d)
8

Description

### Godot version

custom

### System information

Windows 10 Visual Studio 2019

### Issue description

for `R` is `godot::Error`, a 4-byte enum:

```
template
R _call_native_mb_ret(const GDNativeMethodBindPtr mb, void *instance, const Args &...args) {
R ret;
std::array mb_args = { { (const GDNativeTypePtr)args... } };
internal::gdn_interface->object_method_bind_ptrcall(mb, instance, mb_args.data(), &ret);
return ret;
}
```

before object_method_bind_ptrcall:

![image](https://user-images.githubusercontent.com/817160/184677799-3987eba0-7425-44de-bf89-9d849a38d7ec.png)

after object_method_bind_ptrcall:

![image](https://user-images.githubusercontent.com/817160/184677840-88c67ff7-1a98-47fc-9630-c1ddfa6f9bc0.png)

It has written 8 bytes and triggered stack guard detection in Visual Studio. I believe this is real and it may be caused by VARIANT_ENUM_CAST assuming all `enum` are `int64_t` and thus overwriting the 4-byte stack variable on `encode`. reduz would probably know instantly if this is a real issue.

If it becomes relevant, I can try to reproduce this with an official build, but it is hard to do right now because of problems in GDExtension that require me to run various patches. In any case this would be confirmed and fixed by inspection if it is previously unknown.

### Steps to reproduce

Debugging extensions code, and by inspection.

### Minimal reproduction project

_No response_

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.