From cf966391190a5c6b00feeb0f3250202c3d01ff00 Mon Sep 17 00:00:00 2001 From: Kim Kulling Date: Thu, 24 Feb 2022 16:49:35 +0100 Subject: [PATCH] Fix possible negative array access - Return when the calculated offset gets negative - closes https://github.com/assimp/assimp/issues/4414 --- include/assimp/Hash.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/include/assimp/Hash.h b/include/assimp/Hash.h index 1f2baedac..1a5d1f08d 100644 --- a/include/assimp/Hash.h +++ b/include/assimp/Hash.h @@ -4,7 +4,6 @@ Open Asset Import Library (assimp) Copyright (c) 2006-2022, assimp team - All rights reserved. Redistribution and use of this software in source and binary forms, @@ -96,7 +95,11 @@ int rem; switch (rem) { case 3: hash += get16bits (data); hash ^= hash << 16; - hash ^= data[sizeof (uint16_t)] << 18; + size_t offset = static_cast(sizeof(uint16_t)); + if (offset < 0) { + return 0; + } + hash ^= data[offset] << 18; hash += hash >> 11; break; case 2: hash += get16bits (data);