From 128923a262e6e39a9168a4eb31c56b9cc01686ad Mon Sep 17 00:00:00 2001
From: Turo Lamminen <turotl@gmail.com>
Date: Thu, 6 Aug 2015 16:16:34 +0300
Subject: [PATCH] Fix out-of-bounds write on malformed input

---
 code/LWOLoader.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/code/LWOLoader.cpp b/code/LWOLoader.cpp
index 5ec073507..8de88055b 100644
--- a/code/LWOLoader.cpp
+++ b/code/LWOLoader.cpp
@@ -954,6 +954,9 @@ inline void LWOImporter::DoRecursiveVMAPAssignment(VMapEntry* base, unsigned int
     LWO::ReferrerList& refList  = mCurLayer->mPointReferrers;
     unsigned int i;
 
+    if (idx >= base->abAssigned.size()) {
+        throw DeadlyImportError("Bad index");
+    }
     base->abAssigned[idx] = true;
     for (i = 0; i < numRead;++i) {
         base->rawData[idx*base->dims+i]= data[i];