v4games
/
assimp
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix read past end of buffer on malformed LWOB files

pull/450/head
Turo Lamminen 2015-01-27 23:47:22 +02:00
parent 16f9ca35d2
commit 0108d5b1f9
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
code/LWOBLoader.cpp
View File

@ -139,7 +139,15 @@ void LWOImporter::CountVertsAndFacesLWOB(unsigned int& verts, unsigned int& face
while (cursor < end && max--)
{
uint16_t numIndices;
// must have 2 shorts left for numIndices and surface
if (end - cursor < 2) {
throw DeadlyImportError("LWOB: Unexpected end of file");
}
::memcpy(&numIndices, cursor++, 2);
// must have enough left for indices and surface
if (end - cursor < (1 + numIndices)) {
throw DeadlyImportError("LWOB: Unexpected end of file");
}
verts += numIndices;
faces++;
cursor += numIndices;