From 90769ef3e6a6d05691e46024b7415aafda4b9c7d Mon Sep 17 00:00:00 2001 From: Alex Date: Sun, 11 Dec 2022 00:02:09 +0000 Subject: [PATCH] Fixes Heap-buffer-overflow READ 1 in Assimp::MD5::MD5Parser::ParseHeader https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49422 When it reaches the `SkipSpacesAndLineEnd`, `in` already points past `bufferEnd` and it leads to out of bounds memory read. --- code/AssetLib/MD5/MD5Parser.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/code/AssetLib/MD5/MD5Parser.cpp b/code/AssetLib/MD5/MD5Parser.cpp index 2cd738581..02b34fe4b 100644 --- a/code/AssetLib/MD5/MD5Parser.cpp +++ b/code/AssetLib/MD5/MD5Parser.cpp @@ -117,6 +117,8 @@ void MD5Parser::ParseHeader() { ReportError("MD5 version tag is unknown (10 is expected)"); } SkipLine(); + if (buffer == bufferEnd) + return; // print the command line options to the console // FIX: can break the log length limit, so we need to be careful