Core/Collision: Fix BIH::intersectRay crash

Assure that BIHWrap::remove(const T& obj) actually removes every reference of obj from BIHWrap.
Also add sanity checks to MDLCallback () functions to avoid array overruns.

Closes #5218

Signed-off-by: Nay <dnpd.dd@gmail.com>

1 files changed, 13 insertions, 5 deletions

diff --git a/src/server/collision/BoundingIntervalHierarchyWrapper.h b/src/server/collision/BoundingIntervalHierarchyWrapper.h
index 8a99078caab..315f3004306 100644
--- a/src/server/collision/BoundingIntervalHierarchyWrapper.h
+++ b/src/server/collision/BoundingIntervalHierarchyWrapper.h
@@ -33,11 +33,14 @@ class BIHWrap
     {
         const T* const* objects;
         RayCallback& _callback;
+        uint32 objects_size;
 
-        MDLCallback(RayCallback& callback, const T* const* objects_array ) : objects(objects_array), _callback(callback) {}
+        MDLCallback(RayCallback& callback, const T* const* objects_array, uint32 objects_size ) : objects(objects_array), _callback(callback), objects_size(objects_size) {}
 
         bool operator() (const Ray& ray, uint32 Idx, float& MaxDist, bool /*stopAtFirst*/)
         {
+            if (Idx >= objects_size)
+                return false;
             if (const T* obj = objects[Idx])
                 return _callback(ray, *obj, MaxDist/*, stopAtFirst*/);
             return false;
@@ -45,6 +48,8 @@ class BIHWrap
 
         void operator() (const Vector3& p, uint32 Idx)
         {
+            if (Idx >= objects_size)
+                return false;
             if (const T* obj = objects[Idx])
                 _callback(p, *obj);
         }
@@ -87,21 +92,24 @@ public:
         m_objects.fastClear();
         m_obj2Idx.getKeys(m_objects);
         m_objects_to_push.getMembers(m_objects);
+        //assert that m_obj2Idx has all the keys
 
         m_tree.build(m_objects, BoundsFunc::getBounds2);
     }
 
     template<typename RayCallback>
-    void intersectRay(const Ray& ray, RayCallback& intersectCallback, float& maxDist) const
+    void intersectRay(const Ray& ray, RayCallback& intersectCallback, float& maxDist)
     {
-        MDLCallback<RayCallback> temp_cb(intersectCallback, m_objects.getCArray());
+        balance();
+        MDLCallback<RayCallback> temp_cb(intersectCallback, m_objects.getCArray(), m_objects.size());
         m_tree.intersectRay(ray, temp_cb, maxDist, true);
     }
 
     template<typename IsectCallback>
-    void intersectPoint(const Vector3& point, IsectCallback& intersectCallback) const
+    void intersectPoint(const Vector3& point, IsectCallback& intersectCallback)
     {
-        MDLCallback<IsectCallback> callback(intersectCallback, m_objects.getCArray());
+        balance();
+        MDLCallback<IsectCallback> callback(intersectCallback, m_objects.getCArray(), m_objects.size());
         m_tree.intersectPoint(point, callback);
     }
 };