recastnavigation · Issues· 144 open

[Bug]dtGetThenAdvanceBufferPointer pointer-arithmetic overflow: unchecked buffer += distanceToAdvance with no dataSize guard (CWE-466)

[Bug]Signed integer overflow (links index & neighbour-tile coords): maxLinkCount-1 underflows when maxLinkCount=0x80000000 (CWE-190)

[Bug]float→unsigned short quantization cast overflow (float-cast-overflow): attacker-controlled geometry makes qfac*minx out of range (CWE-681)

[Bug]dtPoly::getType() null member access: invalid header leaves poly pointer null (CWE-476)

[Bug]dtNavMesh::connectIntLinks out-of-bounds read: poly vertex index / neis array out of bounds (CWE-125)

[Bug]dtVlerp null-pointer dereference: invalid header yields a null detail-vertex pointer that is then dereferenced (CWE-476)

[Bug]dtNavMesh::connectExtOffMeshLinks OOB read / SEGV: unchecked targetCon->poly (CWE-125)

[Bug]Out-of-bounds pointers from addTile parsing flow into DetourCommon vector/quantization math (dtVsub/dtVcopy/dtOverlapQuantBounds/dtDistancePtSegSqr2D) (CWE-125)

[BUg]dtNavMesh::baseOffMeshLinks out-of-bounds read: unchecked offMeshCon.poly indexes &tile->polys[con->poly] (CWE-125)

[Bug]dtNavMesh::addTile heap out-of-bounds read on short input (no dataSize check when reading dtMeshHeader::magic) (CWE-125)

[Bug]dtNavMesh::addTile out-of-bounds write into links[]: uncontrolled header.maxLinkCount yields a 4-byte heap write (CWE-787)

Signed integer overflow (UB) in dtProximityGrid::hashPos2 for crowds far from the origin

Building error: ‘-Werror=All’: no option ‘-WAll’; did you mean ‘-Wall’? on Fedora 41

Polygons in different layered tiles are not connected when they are in the input mesh

[Resource] Interactive A*/Dijkstra/BFS pathfinding visualizer for learning and demos