Fix possible negative array access

- Return when the calculated offset gets negative
- closes https://github.com/assimp/assimp/issues/4414
pull/4415/head
Kim Kulling 2022-02-24 16:49:35 +01:00 committed by GitHub
parent e3001f1eb7
commit cf96639119
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 2 deletions

View File

@ -4,7 +4,6 @@ Open Asset Import Library (assimp)
Copyright (c) 2006-2022, assimp team
All rights reserved.
Redistribution and use of this software in source and binary forms,
@ -96,7 +95,11 @@ int rem;
switch (rem) {
case 3: hash += get16bits (data);
hash ^= hash << 16;
hash ^= data[sizeof (uint16_t)] << 18;
size_t offset = static_cast<size_t>(sizeof(uint16_t));
if (offset < 0) {
return 0;
}
hash ^= data[offset] << 18;
hash += hash >> 11;
break;
case 2: hash += get16bits (data);