bugfix(worldheightmap): Reject map sizes that overflow the cell array allocations

[tintinhamans]

ParseHeightMapData takes width and height straight from the map file and only checks the data size against m_width*m_height. That product wraps in 32 bits, so absurd dimensions pass and PathfindLayer, PartitionManager and W3DShroud allocate the wrapped count while indexing with the real one.

Both height map parsers now reject an area above 4096x4096, a side above 8192 or a border that does not fit, before allocating. The side limit keeps the shroud texture and the 16 bit shoreline coordinates in range. The largest of the 446 retail and custom maps I tested is 800.

[coderabbitai]

Walkthrough

Height map parsing now validates dimensions, border sizes, and declared data sizes in both full-data and size-only paths. Invalid values produce ERROR_CORRUPT_FILE_FORMAT. Both paths validate data sizes before allocating the buffer.

Changes

Height map validation

Layer / File(s)	Summary
Validate height map parsing Core/GameEngine/Include/Common/MapReaderWriterInfo.h, Core/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp	The parsers enforce dimensions from 1 through MAX_MAP_DIMENSION (8192), limit map area to MAX_MAP_AREA, and validate border sizes. Each parser rejects nonpositive data sizes, sizes unequal to width * height, and sizes greater than the remaining chunk bytes before allocating the buffer.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: xezon

Merge Risk: 🟡 Moderate · up to 89748

Maps exceeding the intended dimension limit can still be accepted. Set the per-dimension limit to 4096 before merging.

Pre-merge checks · 4

Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly identifies the main change: rejecting world height-map sizes that can overflow cell-array allocations.
Description check		The description accurately explains the overflow risk, the validation added to both parsers, the dimension and border limits, and the reported map-size testing.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable defects were found.

Summary

Both height-map parsers now check map dimensions, area, border size, and available height bytes before allocating height data.

• Height-map readers reject invalid map sizes before allocating cell data.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Read dimensions and border] --> B{Dimensions, area and border fit?}
    B -->|No| E[Reject map]
    B -->|Yes| C[Read boundaries and data size]
    C --> D{Data size matches area and fits chunk?}
    D -->|No| E
    D -->|Yes| F[Allocate and read height data]

Loading

_{Reviews (4) · Last reviewed commit: "bugfix(worldheightmap): Reject map sizes..." · Reviewed by Greptile}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7d66925a-87e4-4a90-b43f-92d527b561ae

📥 Commits

Reviewing files that changed from the base of the PR and between 0e6a06c and a5bae28.

📒 Files selected for processing (1)

• Core/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 1 remain after this review.

[Mauller]

Although world builder breaks at the moment when going beyond 1200x1200 due to memory limits, you might want to make sure world builder also adheres to the maximum world dimensions.

[tintinhamans]

Although world builder breaks at the moment when going beyond 1200x1200 due to memory limits, you might want to make sure world builder also adheres to the maximum world dimensions.

I'll cap WorldBuilder at the same limit in a follow-up and look at the memory issue.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3665e2f8-4cc3-461f-a1fd-0ddb7ef65fd3

📥 Commits

Reviewing files that changed from the base of the PR and between 6d6fdf8 and 8974823.

📒 Files selected for processing (2)

• Core/GameEngine/Include/Common/MapReaderWriterInfo.h
• Core/GameEngineDevice/Source/W3DDevice/GameClient/WorldHeightMap.cpp

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

[Mauller]

It might be helpful to also include the reason for the limit, related to the vertex and index buffers being 16bit etc. Otherwise it just looks arbitrary