Merge pull request #3589 from assimp/kimkulling-off_fuzz28288
Fix overflow in aiStringpull/3590/head
commit
0eb9005bc1
|
@ -305,9 +305,9 @@ struct aiString {
|
||||||
|
|
||||||
/** Copy a const char* to the aiString */
|
/** Copy a const char* to the aiString */
|
||||||
void Set(const char *sz) {
|
void Set(const char *sz) {
|
||||||
const ai_int32 len = (ai_uint32)::strlen(sz);
|
ai_int32 len = (ai_uint32)::strlen(sz);
|
||||||
if (len > (ai_int32)MAXLEN - 1) {
|
if (len > (ai_int32)MAXLEN - 1) {
|
||||||
return;
|
len = (ai_int32) MAXLEN - 1;
|
||||||
}
|
}
|
||||||
length = len;
|
length = len;
|
||||||
memcpy(data, sz, len);
|
memcpy(data, sz, len);
|
||||||
|
@ -321,7 +321,10 @@ struct aiString {
|
||||||
}
|
}
|
||||||
|
|
||||||
length = rOther.length;
|
length = rOther.length;
|
||||||
;
|
if (length >(MAXLEN - 1)) {
|
||||||
|
length = (ai_int32) MAXLEN - 1;
|
||||||
|
}
|
||||||
|
|
||||||
memcpy(data, rOther.data, length);
|
memcpy(data, rOther.data, length);
|
||||||
data[length] = '\0';
|
data[length] = '\0';
|
||||||
return *this;
|
return *this;
|
||||||
|
|
Loading…
Reference in New Issue