v4games
/
assimp
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #3575 from ms-maxvollmer/gltf2_buffer_fixes 

Fixes for GLTF2 buffers
pull/3583/head
Kim Kulling 2021-01-14 09:57:39 +01:00 committed by GitHub
parent 20873cb142 87a6305cf0
commit 6d6a6ac11e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
code/AssetLib/glTF2/glTF2Asset.inl
View File

@ -560,18 +560,17 @@ inline void BufferView::Read(Value &obj, Asset &r) {
buffer = r.buffers.Retrieve(bufferVal->GetUint()); buffer = r.buffers.Retrieve(bufferVal->GetUint());
} }
if (!buffer) {
throw DeadlyImportError("GLTF: Buffer view without valid buffer.");
}
byteOffset = MemberOrDefault(obj, "byteOffset", size_t(0)); byteOffset = MemberOrDefault(obj, "byteOffset", size_t(0));
byteLength = MemberOrDefault(obj, "byteLength", size_t(0)); byteLength = MemberOrDefault(obj, "byteLength", size_t(0));
byteStride = MemberOrDefault(obj, "byteStride", 0u); byteStride = MemberOrDefault(obj, "byteStride", 0u);
// Check length // Check length
if ((byteOffset + byteLength) > buffer->byteLength) { if ((byteOffset + byteLength) > buffer->byteLength) {
const uint8_t val_size = 64; throw DeadlyImportError("GLTF: Buffer view with offset/length (", byteOffset, "/", byteLength, ") is out of range.");
char val[val_size];
ai_snprintf(val, val_size, "%llu, %llu", (unsigned long long)byteOffset, (unsigned long long)byteLength);
throw DeadlyImportError("GLTF: Buffer view with offset/length (", val, ") is out of range.");
} }
} }
@ -649,13 +648,14 @@ inline void Accessor::Read(Value &obj, Asset &r) {
if (bufferView) { if (bufferView) {
// Check length // Check length
unsigned long long byteLength = (unsigned long long)GetBytesPerComponent() * (unsigned long long)count; unsigned long long byteLength = (unsigned long long)GetBytesPerComponent() * (unsigned long long)count;
// handle integer overflow
if (byteLength < count) {
throw DeadlyImportError("GLTF: Accessor with offset/count (", byteOffset, "/", count, ") is out of range.");
}
if ((byteOffset + byteLength) > bufferView->byteLength || (bufferView->byteOffset + byteOffset + byteLength) > bufferView->buffer->byteLength) { if ((byteOffset + byteLength) > bufferView->byteLength || (bufferView->byteOffset + byteOffset + byteLength) > bufferView->buffer->byteLength) {
const uint8_t val_size = 64; throw DeadlyImportError("GLTF: Accessor with offset/length (", byteOffset, "/", byteLength, ") is out of range.");
char val[val_size];
ai_snprintf(val, val_size, "%llu, %llu", (unsigned long long)byteOffset, (unsigned long long)byteLength);
throw DeadlyImportError("GLTF: Accessor with offset/length (", val, ") is out of range.");
} }
} }