Skip to content

[InterventionalRadiologyController] Fix various potential bugs - #236

Open
fredroy wants to merge 6 commits into
sofa-framework:masterfrom
fredroy:fix_various_bugs
Open

[InterventionalRadiologyController] Fix various potential bugs#236
fredroy wants to merge 6 commits into
sofa-framework:masterfrom
fredroy:fix_various_bugs

Conversation

@fredroy

@fredroy fredroy commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Based on

(Claude)

Fix Severity Issue Test
1 OOB STEP 3: the prev_xId search could end == m_nodeCurvAbs.size(), then indexed m_nodeCurvAbs[prev_xId] / m_idInstrumentCurvAbsTable[prev_xId] out of bounds. Clamp to the last node. covered by deploy_*
2 OOB A negative controlledInstrument passed the upper-bound-only checks in onBeginAnimationStep() and applyAction() and was used as a negative index. Reject id < 0. action_negativeControlledInstrument_isRejected, deploy_negativeControlledInstrument_fallsBackToZero`
3 OOB computeInstrumentsCurvAbs() accessed xP_noticeable_I[size()-1] unconditionally; an empty sampling vector underflows. Skip such an instrument. defensive
4 Correctness interventionalRadiologyCollisionControls() used 0 as the "nothing to remove" sentinel in segRemove, dropping a collision point at index 0. Use -1. collision-pipeline only
5 OOB STEP 5 rigid-segment loop could compute firstSimulatedNode + i == numberOfNodes (one past the last dof) and pass it to addConstraint. Bound the loop. defensive

@fredroy fredroy added pr: fix pr: clean pr: status to review To notify reviewers to review this pull-request labels Jul 16, 2026
@fredroy
fredroy force-pushed the fix_various_bugs branch from dbdcfc0 to 3aec1ed Compare July 20, 2026 04:42
@fredroy
fredroy force-pushed the fix_various_bugs branch from 3aec1ed to 9f344fd Compare July 30, 2026 01:32
In applyInterventionalRadiologyController() STEP 3, the search for the
previous node could leave prev_xId == m_nodeCurvAbs.size() (the "Case 1"
path), leading to out-of-bounds reads of m_nodeCurvAbs[prev_xId] and
m_idInstrumentCurvAbsTable[prev_xId]. Clamp prev_xId to the last node.
The loop fixing rigid-segment border nodes could compute
firstSimulatedNode + i == numberOfNodes (one past the last dof) and pass it
to FixedProjectiveConstraint::addConstraint. Stop the loop before the index
leaves the valid dof range.
Comment thread src/BeamAdapter/component/controller/InterventionalRadiologyController.inl Outdated
…ntroller.inl

Co-authored-by: Alex Bilger <alxbilger@users.noreply.github.com>
Comment on lines +503 to +504
// an instrument must provide at least one noticeable point; otherwise the loop below and the
// final key point access (xP_noticeable_I.size()-1) would read out of bounds.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// an instrument must provide at least one noticeable point; otherwise the loop below and the
// final key point access (xP_noticeable_I.size()-1) would read out of bounds.
// Detect if the instrument does not provide at least one noticeable point


for (unsigned int it=0; it<m_instrumentsList.size(); it++)
segRemove.push_back(0);
// -1 means "nothing to remove" for that instrument; using 0 as sentinel would drop a point at index 0.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// -1 means "nothing to remove" for that instrument; using 0 as sentinel would drop a point at index 0.
// Initialize the segRemove vector using -1 meaning "nothing to remove" for that instrument

Comment on lines +859 to +860
// If no previous node was found beyond xCurvAbs (see the "Case 1" warning above), the loop
// ends with prev_xId == m_nodeCurvAbs.size(): clamp to the last node to avoid out-of-bounds access.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// If no previous node was found beyond xCurvAbs (see the "Case 1" warning above), the loop
// ends with prev_xId == m_nodeCurvAbs.size(): clamp to the last node to avoid out-of-bounds access.
// In case prev_xId exceeds size of m_nodeCurvAbs, clamp to the last node to avoid out-of-bounds access

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pr: clean pr: fix pr: status to review To notify reviewers to review this pull-request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants