From d3166cb630483c26e19de6353ea72f66bdb1a25a Mon Sep 17 00:00:00 2001 From: Google DeepMind Date: Wed, 22 Jul 2026 03:53:08 -0700 Subject: [PATCH] Fix cylinder bias stack overrun in XML parsing PiperOrigin-RevId: 952016771 Change-Id: I49657d41ad96a6bd1f7f9d5e6b6491c5a229d244 --- src/xml/xml_native_reader.cc | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/xml/xml_native_reader.cc b/src/xml/xml_native_reader.cc index 6ad9c563..6901d261 100644 --- a/src/xml/xml_native_reader.cc +++ b/src/xml/xml_native_reader.cc @@ -2619,14 +2619,16 @@ void mjXReader::OneActuator(XMLElement* elem, mjsActuator* actuator) { // cylinder else if (type == "cylinder") { double timeconst = actuator->dynprm[0]; - double bias = actuator->biasprm[0]; + double bias[3] = {actuator->biasprm[0], actuator->biasprm[1], actuator->biasprm[2]}; double area = actuator->gainprm[0]; double diameter = -1; ReadAttr(elem, "timeconst", 1, &timeconst, text); - ReadAttr(elem, "bias", 3, &bias, text); + ReadAttr(elem, "bias", 3, bias, text); ReadAttr(elem, "area", 1, &area, text); ReadAttr(elem, "diameter", 1, &diameter, text); - err = mjs_setToCylinder(actuator, timeconst, bias, area, diameter); + err = mjs_setToCylinder(actuator, timeconst, bias[0], area, diameter); + actuator->biasprm[1] = bias[1]; + actuator->biasprm[2] = bias[2]; } // muscle