v4games
/
assimp
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix overflow in IOStreamBuffer 

`getNextLine` & `getNextDataLine` now double the buffer size each time
it is needed to avoid writing out of bounds.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24465
pull/4146/head
Alex Rebert 2021-10-28 23:33:07 -04:00
parent 6a3ac623b9
commit 1909b3e8d2
No known key found for this signature in database
GPG Key ID: E082090D746F1A81
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
include/assimp/IOStreamBuffer.h
View File

@ -261,6 +261,11 @@ AI_FORCE_INLINE bool IOStreamBuffer<T>::getNextDataLine(std::vector<T> &buffer,
buffer[i] = m_cache[m_cachePos]; buffer[i] = m_cache[m_cachePos];
++m_cachePos; ++m_cachePos;
++i; ++i;
if(i == buffer.size()) {
buffer.resize(buffer.size() * 2);
}
if (m_cachePos >= size()) { if (m_cachePos >= size()) {
break; break;
} }
@ -308,6 +313,11 @@ AI_FORCE_INLINE bool IOStreamBuffer<T>::getNextLine(std::vector<T> &buffer) {
buffer[i] = m_cache[m_cachePos]; buffer[i] = m_cache[m_cachePos];
++m_cachePos; ++m_cachePos;
++i; ++i;
if(i == buffer.size()) {
buffer.resize(buffer.size() * 2);
}
if (m_cachePos >= m_cacheSize) { if (m_cachePos >= m_cacheSize) {
if (!readNextBlock()) { if (!readNextBlock()) {
return false; return false;