Prevent out-of-range memory writes by sparse accessors
This turned up during fuzz testing. Corrupted data would make assimp write to random memory locations, leading to subsequent crashes.pull/4207/head
parent
889e559696
commit
1a5d66714f
|
@ -809,6 +809,11 @@ inline void Accessor::Sparse::PatchData(unsigned int elementSize) {
|
||||||
}
|
}
|
||||||
|
|
||||||
offset *= elementSize;
|
offset *= elementSize;
|
||||||
|
|
||||||
|
if (offset + elementSize > data.size()) {
|
||||||
|
throw DeadlyImportError("Invalid sparse accessor. Byte offset for patching points outside allocated memory.");
|
||||||
|
}
|
||||||
|
|
||||||
std::memcpy(data.data() + offset, pValues, elementSize);
|
std::memcpy(data.data() + offset, pValues, elementSize);
|
||||||
|
|
||||||
pValues += elementSize;
|
pValues += elementSize;
|
||||||
|
|
Loading…
Reference in New Issue