Add various checks to avoid either too large or zero-sized memory allocations

code/ACLoader.cpp

@@ -587,9 +587,19 @@ aiNode* AC3DImporter::ConvertObjectSection(Object& object,
 
                 // allocate storage for vertices and normals
                 mesh->mNumFaces = (*cit).first;
+                if (mesh->mNumFaces == 0) {
+                    throw DeadlyImportError("AC3D: No faces");
+                } else if (mesh->mNumFaces > std::numeric_limits<int32_t>::max() / sizeof(aiFace)) {
+                    throw DeadlyImportError("AC3D: Too many faces, would run out of memory");
+                }
                 aiFace* faces = mesh->mFaces = new aiFace[mesh->mNumFaces];
 
                 mesh->mNumVertices = (*cit).second;
+                if (mesh->mNumVertices == 0) {
+                    throw DeadlyImportError("AC3D: No vertices");
+                } else if (mesh->mNumVertices > std::numeric_limits<int32_t>::max() / sizeof(aiVector3D)) {
+                    throw DeadlyImportError("AC3D: Too many vertices, would run out of memory");
+                }
                 aiVector3D* vertices = mesh->mVertices = new aiVector3D[mesh->mNumVertices];
                 unsigned int cur = 0;
 

code/MD3Loader.cpp

@@ -783,6 +783,11 @@ void MD3Importer::InternReadFile( const std::string& pFile,
 
     // Allocate output storage
     pScene->mNumMeshes = pcHeader->NUM_SURFACES;
+    if (pcHeader->NUM_SURFACES == 0) {
+        throw DeadlyImportError("MD3: No surfaces");
+    } else if (pcHeader->NUM_SURFACES > std::numeric_limits<int32_t>::max() / sizeof(aiMesh)) {
+        throw DeadlyImportError("MD3: Too many surfaces, would run out of memory");
+    }
     pScene->mMeshes = new aiMesh*[pScene->mNumMeshes];
 
     pScene->mNumMaterials = pcHeader->NUM_SURFACES;

code/ObjFileImporter.cpp

@@ -380,6 +380,11 @@ void ObjFileImporter::createVertexArray(const ObjFile::Model* pModel,
 
     // Copy vertices of this mesh instance
     pMesh->mNumVertices = numIndices;
+    if (pMesh->mNumVertices == 0) {
+        throw DeadlyImportError( "OBJ: no vertices" );
+    } else if (pMesh->mNumVertices > std::numeric_limits<int32_t>::max() / sizeof(aiVector3D)) {
+        throw DeadlyImportError( "OBJ: Too many vertices, would run out of memory" );
+    }
     pMesh->mVertices = new aiVector3D[ pMesh->mNumVertices ];
 
     // Allocate buffer for normal vectors