Skip to content

Fix OOB access on zero-submesh entities in scene export - #197

Merged
fernandotonon merged 2 commits into
masterfrom
fix/sonar-oob-mesh-array
Mar 16, 2026
Merged

Fix OOB access on zero-submesh entities in scene export#197
fernandotonon merged 2 commits into
masterfrom
fix/sonar-oob-mesh-array

Conversation

@fernandotonon

@fernandotonon fernandotonon commented Mar 16, 2026

Copy link
Copy Markdown
Owner

Summary

  • Fix 2 BLOCKER SonarCloud issues (cpp:S3519): out-of-bounds access when new aiMesh*[0] creates a zero-length array

Changes

Guard mesh array allocation in both buildAiScene (single-entity) and buildSceneAiScene (multi-entity) to use nullptr when the submesh count is zero. The inner iteration loops are already guarded by si < numSub, so with nullptr instead of a zero-length allocation, there is no undefined behavior.

Test plan

  • All 32 MeshImporterExporter tests pass
  • SonarCloud analysis on this PR should clear the 2 BLOCKER issues

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Bug Fixes

    • Prevented invalid allocations when meshes are absent, improving stability and avoiding potential runtime issues.
  • New Features

    • Added Snap Store installation option and clarified Linux installation flow with optional .deb alternative.
  • Chores

    • Project version updated to 2.14.2 and README/docs updated with install badges and formatting tweaks.

@coderabbitai

coderabbitai Bot commented Mar 16, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9db3abb6-ce1e-4167-ad16-6cd53fb61748

📥 Commits

Reviewing files that changed from the base of the PR and between b6b7335 and 346ec15.

📒 Files selected for processing (4)
  • CMakeLists.txt
  • README.md
  • docs/index.html
  • src/MeshImporterExporter.cpp
🚧 Files skipped from review as they are similar to previous changes (1)
  • src/MeshImporterExporter.cpp

📝 Walkthrough

Walkthrough

Replaces unconditional aiMesh* array allocations with conditional allocations that use nullptr when mesh counts are zero; updates project version and installation docs (Snap/.deb) and adds a Snap Store badge to README.

Changes

Cohort / File(s) Summary
Core source
src/MeshImporterExporter.cpp
Guarded aiMesh* array allocations in buildAiScene/buildSceneAiScene to avoid zero-sized allocations; allocation now happens only when mesh count > 0, otherwise set to nullptr.
Build metadata
CMakeLists.txt
Bumped project VERSION from 2.14.1 to 2.14.2.
Documentation / Website
README.md, docs/index.html
Added Snap Store badge and Snap install instructions; reworked Linux installation section to recommend Snap and also show .deb alternative; adjusted headings and removal commands.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

Poem

🐰 A rabbit hops through memory lanes,
Where zero meshes caused some pains,
Guards now stand where gaps would be,
nullptrs keep the heap tidy and free,
Hooray for checks and softer gains.

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title directly and accurately summarizes the main fix: preventing out-of-bounds access when zero-submesh entities are exported.
Description check ✅ Passed The description covers the template structure with a summary of the fix and technical details, though it deviates from the template's section headings and lacks explicit feature/bugfix categorization.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
  • 📝 Generate docstrings (stacked PR)
  • 📝 Generate docstrings (commit on current branch)
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix/sonar-oob-mesh-array
📝 Coding Plan
  • Generate coding plan for human review comments

Comment @coderabbitai help to get the list of available commands and usage tips.

SonarCloud flagged BLOCKER: `new aiMesh*[0]` creates a zero-length
allocation; any subsequent index access is undefined behavior. Guard
both buildAiScene and buildSceneAiScene to use nullptr when the mesh
count is zero, so the inner loops (already guarded by `si < numSub`)
never dereference a zero-length array.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@fernandotonon
fernandotonon force-pushed the fix/sonar-oob-mesh-array branch from b6b7335 to 2f8ee0a Compare March 16, 2026 01:24
- Bump version: 2.14.1 → 2.14.2
- README: Add Snap Store as recommended Linux install method with badge
- docs/index.html: Add Snap Store to Quick Start section

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@fernandotonon
fernandotonon merged commit 08db53b into master Mar 16, 2026
11 checks passed
@fernandotonon
fernandotonon deleted the fix/sonar-oob-mesh-array branch March 16, 2026 01:30
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant