{"action":"created","issue":{"url":"https://api.github.com/repos/bkaradzic/bgfx/issues/760","repository_url":"https://api.github.com/repos/bkaradzic/bgfx","labels_url":"https://api.github.com/repos/bkaradzic/bgfx/issues/760/labels{/name}","comments_url":"https://api.github.com/repos/bkaradzic/bgfx/issues/760/comments","events_url":"https://api.github.com/repos/bkaradzic/bgfx/issues/760/events","html_url":"https://github.com/bkaradzic/bgfx/issues/760","id":148937454,"number":760,"title":"Dynamic vertex buffer overrun bug","user":{"login":"a-newton","id":9194539,"avatar_url":"https://avatars.githubusercontent.com/u/9194539?v=3","gravatar_id":"","url":"https://api.github.com/users/a-newton","html_url":"https://github.com/a-newton","followers_url":"https://api.github.com/users/a-newton/followers","following_url":"https://api.github.com/users/a-newton/following{/other_user}","gists_url":"https://api.github.com/users/a-newton/gists{/gist_id}","starred_url":"https://api.github.com/users/a-newton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/a-newton/subscriptions","organizations_url":"https://api.github.com/users/a-newton/orgs","repos_url":"https://api.github.com/users/a-newton/repos","events_url":"https://api.github.com/users/a-newton/events{/privacy}","received_events_url":"https://api.github.com/users/a-newton/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-17T10:14:41Z","updated_at":"2016-04-18T21:33:46Z","closed_at":null,"body":"The alignment applied to `dvb.m_startVertex` in `createDynamicVertexBuffer` can cause the allocation block to overlap with the next allocation or to shift off the end of the vertex buffer (causing D3D to fall over when attempting to lock outside of the buffer).\r\n[https://github.com/bkaradzic/bgfx/blob/master/src/bgfx_p.h#L2495]\r\n\r\nI think the allocated buffer size needs to be increased by `_decl.m_stride` to account for this additional alignment."},"comment":{"url":"https://api.github.com/repos/bkaradzic/bgfx/issues/comments/211592488","html_url":"https://github.com/bkaradzic/bgfx/issues/760#issuecomment-211592488","issue_url":"https://api.github.com/repos/bkaradzic/bgfx/issues/760","id":211592488,"user":{"login":"a-newton","id":9194539,"avatar_url":"https://avatars.githubusercontent.com/u/9194539?v=3","gravatar_id":"","url":"https://api.github.com/users/a-newton","html_url":"https://github.com/a-newton","followers_url":"https://api.github.com/users/a-newton/followers","following_url":"https://api.github.com/users/a-newton/following{/other_user}","gists_url":"https://api.github.com/users/a-newton/gists{/gist_id}","starred_url":"https://api.github.com/users/a-newton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/a-newton/subscriptions","organizations_url":"https://api.github.com/users/a-newton/orgs","repos_url":"https://api.github.com/users/a-newton/repos","events_url":"https://api.github.com/users/a-newton/events{/privacy}","received_events_url":"https://api.github.com/users/a-newton/received_events","type":"User","site_admin":false},"created_at":"2016-04-18T21:33:45Z","updated_at":"2016-04-18T21:33:45Z","body":"To reproduce the issue copy the following code in to cubes.cpp sample and call `vb_overrun()` from the end of `ExampleCubes::init()`. Crashes on DX9, DX11 and Windows GL.\r\n\r\n```\r\nvoid vb_overrun()\r\n{\r\n   struct ThinVertex\r\n   {\r\n      float pos[3];\r\n      uint32_t col;\r\n   };\r\n   bgfx::VertexDecl thin_decl_16_bytes;\r\n   thin_decl_16_bytes\r\n      .begin()\r\n      .add(bgfx::Attrib::Position, 3, bgfx::AttribType::Float)\r\n      .add(bgfx::Attrib::Color0,   4, bgfx::AttribType::Uint8, true)\r\n      .end();\r\n   struct FatVertex\r\n   {\r\n      float pos[3];\r\n      float uv0[2];\r\n      float uv1[2];\r\n      float uv2[2];\r\n   };\r\n   bgfx::VertexDecl fat_decl_36_bytes;\r\n   fat_decl_36_bytes\r\n      .begin()\r\n      .add(bgfx::Attrib::Position,    3, bgfx::AttribType::Float)\r\n      .add(bgfx::Attrib::TexCoord0,   2, bgfx::AttribType::Float)\r\n      .add(bgfx::Attrib::TexCoord1,   2, bgfx::AttribType::Float)\r\n      .add(bgfx::Attrib::TexCoord2,   2, bgfx::AttribType::Float)\r\n      .end();\r\n   const uint32_t N = 4;\r\n   const uint32_t N_size = N*fat_decl_36_bytes.getStride();\r\n\r\n   const uint32_t config_dynamic_vb_size = 3 << 20;\r\n\r\n   // Firstly pad the internal dynamic vertex buffer ensuring there is space remaining for N fat verts\r\n   // This causes the internal vb to have space for N verts but crucially the internal offset is not aligned to 36 bytes\r\n   static bgfx::DynamicVertexBufferHandle dvb_pad = bgfx::createDynamicVertexBuffer((config_dynamic_vb_size-N_size) / thin_decl_16_bytes.getStride(), thin_decl_16_bytes);\r\n\r\n   // now allocate space for N fat verts and update the buffer. This will crash the render thread when it process the command\r\n   static bgfx::DynamicVertexBufferHandle dvb_overrun = bgfx::createDynamicVertexBuffer(N, fat_decl_36_bytes);\r\n   BX_CHECK(bgfx::isValid(dvb_overrun));\r\n   FatVertex data[N];\r\n   bgfx::updateDynamicVertexBuffer(dvb_overrun, 0, bgfx::makeRef(data, N_size));\r\n}\r\n```"}}