From 0bfa4e984c15f36401e1dd16ffd85ce92300343a Mon Sep 17 00:00:00 2001
From: Kyle Bayes <kylebayes@google.com>
Date: Mon, 3 Aug 2026 12:06:27 -0700
Subject: [PATCH] Fix latent bug in multiccd so that we can never write more
 contacts than what the buffer space allows.

PiperOrigin-RevId: 958505449
Change-Id: I77cb1142405df5107be46ca0dbef6effc690028d
---
 src/engine/engine_collision_gjk.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/engine/engine_collision_gjk.c b/src/engine/engine_collision_gjk.c
index 43afeda1..f0231dd6 100644
--- a/src/engine/engine_collision_gjk.c
+++ b/src/engine/engine_collision_gjk.c
@@ -1727,10 +1727,12 @@ static void polygonClip(mjCCDStatus* status, const mjtNum* face1, int nface1,
     return;
   }
 
-  // no pruning needed
-  for (int i = 0; i < 3*npolygon; i += 3) {
-    copy3(status->x2 + i, polygon + i);
-    sub3(status->x1 + i, status->x2 + i, dir);
+  // no pruning needed (cap to max contacts)
+  int maxcon = sizeof(status->x2) / (3*sizeof(status->x2[0]));
+  npolygon = (npolygon < maxcon) ? npolygon : maxcon;
+  for (int i = 0; i < npolygon; i++) {
+    copy3(status->x2 + 3*i, polygon + 3*i);
+    sub3(status->x1 + 3*i, status->x2 + 3*i, dir);
   }
   status->nx = npolygon;
 }