镜像站点 · 本页由第三方 GitHub 只读镜像提供,非 GitHub 官方站点,不接受任何登录或凭据输入。前往 github.com
Skip to content

[rlsw] Fix matrix stack underflow in swPopMatrix() - #6362

Open
shadye-6 wants to merge 1 commit into
raysan5:masterfrom
shadye-6:fix-rlsw-matrix-underflow
Open

shadye-6 wants to merge 1 commit into
raysan5:masterfrom
shadye-6:fix-rlsw-matrix-underflow

Conversation

@shadye-6

@shadye-6 shadye-6 commented Nov 3, 2026 •

Copy link
Copy Markdown

Summary

Fix matrix stack underflow in swPopMatrix() for all three matrix modes in src/external/rlsw.h.

Closes #6361

Problem

during initialization, projection, modelview, and texture matrix stack counters are initialized to 1, representing their initial matrices. but, swPopMatrix() previously checked whether the respective counter was <= 0 before decrementing it.
When popping a stack containing only its initial matrix (counter == 1), the check was bypassed. The counter was decremented to zero, and the subsequent - 1 index calculation underflowed the uint32_t counter to 4294967295.
resulted in RLSW.currentMatrix pointing outside the corresponding matrix stack. subsequent matrix operations then caused out-of-bounds writes and AddressSanitizer segmentation faults.
affected SW_PROJECTION, SW_MODELVIEW, and SW_TEXTURE.

Solution

Changed the underflow checks for all three matrix stacks from <= 0 to <= 1.
This prevents popping the initial matrix, sets SW_STACK_UNDERFLOW, and preserves the existing matrix stack state.

Testing

I verified using a standalone rlsw test harness compiled with Clang 18.1.3, AddressSanitizer, and UndefinedBehaviorSanitizer:

  • Before the fix: All three matrix modes produced UBSan out-of-bounds diagnostics followed by ASan segmentation faults when the invalid matrix pointer was used.
  • After the fix: All three modes correctly returned SW_STACK_UNDERFLOW (1284) without sanitizer errors.
  • Normal swPushMatrix(), matrix transformations, and swPopMatrix() operations were tested across all three modes and continued to work correctly.

standalone reproducer was tested on Ubuntu 24.04.3 LTS under WSL2.

The matrix stack counters start at 1 for their initial matrices. Reject pops when the counter is <= 1 to prevent out-of-bounds access and correctly report SW_STACK_UNDERFLOW.
@shadye-6

shadye-6 commented Nov 4, 2026 •

Copy link
Copy Markdown
Author

hey @raysan5, just following up on this PR, it's a pretty small fix, could you pls review? thanks for your time.

@raysan5

raysan5 commented Nov 5, 2026

Copy link
Copy Markdown
Owner

@Bigfoot71 it looks good to me, despite the apparently AI generated issue, but please, could you take a second look to confirm merge?

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[rlsw] Fix matrix stack underflow in swPopMatrix()

2 participants