From b12293ebf0902f171c0ff31f8edba7186edfe423 Mon Sep 17 00:00:00 2001 From: Jamie Pate Date: Tue, 20 May 2025 15:20:00 -0700 Subject: [PATCH] Fix Heap buffer overflow in Animation::_find() Fixes #106647 (cherry picked from commit c317549587339f508b9fdf863354d258c726b8f8) --- scene/resources/animation.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scene/resources/animation.cpp b/scene/resources/animation.cpp index 75869f019a..b1d6e10f35 100644 --- a/scene/resources/animation.cpp +++ b/scene/resources/animation.cpp @@ -2443,7 +2443,7 @@ int Animation::_find(const Vector &p_keys, double p_time, bool p_backward, bo } } - if (p_limit) { + if (p_limit && middle > -1 && middle < len) { double diff = length - keys[middle].time; if ((signbit(keys[middle].time) && !Math::is_zero_approx(keys[middle].time)) || (signbit(diff) && !Math::is_zero_approx(diff))) { ERR_PRINT_ONCE_ED("Found the key outside the animation range. Consider using the clean-up option in AnimationTrackEditor to fix it.");