fix: out-of-bounds read computing tool-ordering max layer height (#14665)

* fix: out-of-bounds read computing tool-ordering max layer height

calc_max_layer_height() loops over the extruder count (nozzle_diameter)
but indexes max_layer_height with the same counter, reading past the end
when that array is shorter. Silent on release builds, aborts under a
bounds-checked STL (_GLIBCXX_ASSERTIONS).

Read via get_at(), which falls back to the first entry when the index is
out of range, as Slicing.cpp already does for this option.

Add a fff_print regression test slicing a two-extruder printer with a
single-entry max_layer_height.

* docs: clarify how max_layer_height ends up short in the regression test

Normalization sizes it to the filament count under single_extruder_multi_material,
not "a mismatch a profile can ship" as the earlier comment guessed.
This commit is contained in:
Kris Austin
2026-07-09 02:47:57 -05:00
committed by GitHub
parent 2194037d16
commit 6fda82476d
2 changed files with 21 additions and 1 deletions

View File

@@ -138,7 +138,8 @@ static double calc_max_layer_height(const PrintConfig &config, double max_object
{
double max_layer_height = std::numeric_limits<double>::max();
for (size_t i = 0; i < config.nozzle_diameter.values.size(); ++ i) {
double mlh = config.max_layer_height.values[i];
// max_layer_height may be shorter than the extruder count; get_at() clamps.
double mlh = config.max_layer_height.get_at(i);
if (mlh == 0.)
mlh = 0.75 * config.nozzle_diameter.values[i];
max_layer_height = std::min(max_layer_height, mlh);

View File

@@ -85,3 +85,22 @@ TEST_CASE("Per-object wall filament override is honored", "[MultiFilament]")
CHECK(tools_for_role(gcode, "perimeter") == std::set<int>{ 0, 1 });
CHECK(tools_for_role(gcode, "infill") == std::set<int>{ 0 }); // infill not overridden: stays on F1
}
// max_layer_height can be shorter than the extruder count (normalization sizes it to the
// filament count under single_extruder_multi_material). calc_max_layer_height() in ToolOrdering
// indexed it per-nozzle and read past the end. Shortened directly here to isolate that read;
// the other per-extruder keys stay extruder-length so slicing reaches the code under test.
TEST_CASE("Multi-extruder slice stays in bounds with a short max_layer_height", "[MultiFilament]")
{
DynamicPrintConfig config = multifilament_config(2);
config.set_deserialize_strict({
{ "nozzle_diameter", "0.4,0.4" },
{ "printer_extruder_id", "1,2" },
{ "printer_extruder_variant", "Direct Drive Standard,Direct Drive Standard" },
{ "extruder_printable_height", "0,0" },
{ "max_layer_height", "0.3" }, // deliberately one entry short
});
Print print;
init_and_process_print({ cube(20) }, print, config);
REQUIRE_FALSE(print.objects().front()->layers().empty());
}