From 69dae9599a4bf7c7ce50a6ed672ef3d017cb1f90 Mon Sep 17 00:00:00 2001
From: Kim Kulling <kimkulling@users.noreply.github.com>
Date: Fri, 22 Dec 2023 11:57:43 +0100
Subject: [PATCH] Fix integer overflow

- closes https://github.com/assimp/assimp/issues/4930
---
 code/AssetLib/MDL/MDLMaterialLoader.cpp | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/code/AssetLib/MDL/MDLMaterialLoader.cpp b/code/AssetLib/MDL/MDLMaterialLoader.cpp
index 3d39fa645..57ed6c7b9 100644
--- a/code/AssetLib/MDL/MDLMaterialLoader.cpp
+++ b/code/AssetLib/MDL/MDLMaterialLoader.cpp
@@ -123,9 +123,8 @@ aiColor4D MDLImporter::ReplaceTextureWithColor(const aiTexture *pcTexture) {
 // Read a texture from a MDL3 file
 void MDLImporter::CreateTextureARGB8_3DGS_MDL3(const unsigned char *szData) {
     const MDL::Header *pcHeader = (const MDL::Header *)mBuffer; //the endianness is already corrected in the InternReadFile_3DGS_MDL345 function
-
-    VALIDATE_FILE_SIZE(szData + pcHeader->skinwidth *
-                                        pcHeader->skinheight);
+    const size_t len = pcHeader->skinwidth * pcHeader->skinheight);
+    VALIDATE_FILE_SIZE(szData + len);
 
     // allocate a new texture object
     aiTexture *pcNew = new aiTexture();