From 76de7cedf48417ef55f080898a43eac6d5a00ff0 Mon Sep 17 00:00:00 2001 From: Florian Born <44984048+FlorianBorn71@users.noreply.github.com> Date: Tue, 23 Jul 2024 16:17:54 +0200 Subject: [PATCH] A fuzzed stride could cause the max count to become negative and hence wrap around uint (#5414) Co-authored-by: Kim Kulling --- code/AssetLib/glTF2/glTF2Asset.inl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/code/AssetLib/glTF2/glTF2Asset.inl b/code/AssetLib/glTF2/glTF2Asset.inl index 3d309049e..3ae5e48b1 100644 --- a/code/AssetLib/glTF2/glTF2Asset.inl +++ b/code/AssetLib/glTF2/glTF2Asset.inl @@ -1036,10 +1036,10 @@ size_t Accessor::ExtractData(T *&outData, const std::vector *remap outData = new T[usedCount]; if (remappingIndices != nullptr) { - const unsigned int maxIndex = static_cast(maxSize / stride - 1); + const unsigned int maxIndexCount = static_cast(maxSize / stride); for (size_t i = 0; i < usedCount; ++i) { size_t srcIdx = (*remappingIndices)[i]; - if (srcIdx > maxIndex) { + if (srcIdx >= maxIndexCount) { throw DeadlyImportError("GLTF: index*stride ", (srcIdx * stride), " > maxSize ", maxSize, " in ", getContextForErrorMessages(id, name)); } memcpy(outData + i, data + srcIdx * stride, elemSize);