From a578be88e07b54da741fbb1644c11038f42bc288 Mon Sep 17 00:00:00 2001 From: badlogic Date: Fri, 10 Aug 2018 11:11:15 +0200 Subject: [PATCH 1/2] [cocos2dx][c] Fixed call to spVertexAttachment_computeWorldVertices, as well as count calcalculation. --- spine-c/spine-c/src/spine/VertexAttachment.c | 2 +- spine-cocos2dx/src/spine/SkeletonRenderer.cpp | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/spine-c/spine-c/src/spine/VertexAttachment.c b/spine-c/spine-c/src/spine/VertexAttachment.c index 8b6dfea36..14087815e 100644 --- a/spine-c/spine-c/src/spine/VertexAttachment.c +++ b/spine-c/spine-c/src/spine/VertexAttachment.c @@ -51,7 +51,7 @@ void spVertexAttachment_computeWorldVertices (spVertexAttachment* self, spSlot* float* vertices; int* bones; - count += offset; + count = offset + (count >> 1) * stride; skeleton = slot->bone->skeleton; deformLength = slot->attachmentVerticesCount; deform = slot->attachmentVertices; diff --git a/spine-cocos2dx/src/spine/SkeletonRenderer.cpp b/spine-cocos2dx/src/spine/SkeletonRenderer.cpp index 2fd87e351..061ef5805 100644 --- a/spine-cocos2dx/src/spine/SkeletonRenderer.cpp +++ b/spine-cocos2dx/src/spine/SkeletonRenderer.cpp @@ -345,7 +345,7 @@ void SkeletonRenderer::draw (Renderer* renderer, const Mat4& transform, uint32_t triangles.vertCount = attachmentVertices->_triangles->vertCount; memcpy(triangles.verts, attachmentVertices->_triangles->verts, sizeof(cocos2d::V3F_C4B_T2F) * attachmentVertices->_triangles->vertCount); int vertexSizeInFloats = sizeof(cocos2d::V3F_C4B_T2F) / sizeof(float); - spVertexAttachment_computeWorldVertices(SUPER(attachment), slot, 0, triangles.vertCount * vertexSizeInFloats, (float*)triangles.verts, 0, vertexSizeInFloats); + spVertexAttachment_computeWorldVertices(SUPER(attachment), slot, 0, attachment->super.worldVerticesLength, (float*)triangles.verts, 0, vertexSizeInFloats); } else { trianglesTwoColor.indices = attachmentVertices->_triangles->indices; trianglesTwoColor.indexCount = attachmentVertices->_triangles->indexCount; @@ -355,7 +355,7 @@ void SkeletonRenderer::draw (Renderer* renderer, const Mat4& transform, uint32_t trianglesTwoColor.verts[i].texCoords = attachmentVertices->_triangles->verts[i].texCoords; } int vertexSizeInFloats = sizeof(V3F_C4B_C4B_T2F) / sizeof(float); - spVertexAttachment_computeWorldVertices(SUPER(attachment), slot, 0, trianglesTwoColor.vertCount * vertexSizeInFloats, (float*)trianglesTwoColor.verts, 0, vertexSizeInFloats); + spVertexAttachment_computeWorldVertices(SUPER(attachment), slot, 0, attachment->super.worldVerticesLength, (float*)trianglesTwoColor.verts, 0, vertexSizeInFloats); } color.r = attachment->color.r; From 1c86d6394147a4b7b6b68ebb35d04716e3a9a839 Mon Sep 17 00:00:00 2001 From: badlogic Date: Fri, 10 Aug 2018 11:52:59 +0200 Subject: [PATCH 2/2] [cpp] Fixes #1159, illegal memory access in Vector. --- spine-cpp/spine-cpp/include/spine/Vector.h | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/spine-cpp/spine-cpp/include/spine/Vector.h b/spine-cpp/spine-cpp/include/spine/Vector.h index 468aaacef..202885713 100644 --- a/spine-cpp/spine-cpp/include/spine/Vector.h +++ b/spine-cpp/spine-cpp/include/spine/Vector.h @@ -95,11 +95,18 @@ public: inline void add(const T &inValue) { if (_size == _capacity) { + // inValue might reference an element in this buffer + // When we reallocate, the reference becomes invalid. + // We thus need to create a defensive copy before + // reallocating. + T valueCopy = inValue; _capacity = (int) (_size * 1.75f); if (_capacity < 8) _capacity = 8; - _buffer = Spine::SpineExtension::realloc(_buffer, _capacity, __FILE__, __LINE__); + _buffer = spine::SpineExtension::realloc(_buffer, _capacity, __FILE__, __LINE__); + construct(_buffer + _size++, valueCopy); + } else { + construct(_buffer + _size++, inValue); } - construct(_buffer + _size++, inValue); } inline void addAll(Vector &inValue) {