From da87178a25291c00081c9cc205eaa6a6e3883844 Mon Sep 17 00:00:00 2001
From: aramis_acg <aramis_acg@67173fc5-114c-0410-ac8e-9d2fd5bffc1f>
Date: Tue, 13 Apr 2010 15:51:18 +0000
Subject: [PATCH] Fix: OgreImporter overflows a vector if no weight assignments
 are given.

git-svn-id: https://assimp.svn.sourceforge.net/svnroot/assimp/trunk@676 67173fc5-114c-0410-ac8e-9d2fd5bffc1f
---
 code/OgreImporter.cpp | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/code/OgreImporter.cpp b/code/OgreImporter.cpp
index f0a8c21e1..66883ae01 100644
--- a/code/OgreImporter.cpp
+++ b/code/OgreImporter.cpp
@@ -260,7 +260,7 @@ void OgreImporter::ReadSubMesh(SubMesh &theSubMesh, XmlReader *Reader)
 	vector<aiVector3D> UniquePositions(UniqueVertexCount);
 	vector<aiVector3D> UniqueNormals(UniqueVertexCount);
 	vector<aiVector3D> UniqueUvs(UniqueVertexCount);
-	vector< vector<Weight> > UniqueWeights(UniqueVertexCount);
+	vector< vector<Weight> > UniqueWeights((theSubMesh.Weights.size() ? UniqueVertexCount : 0));
 
 	for(unsigned int i=0; i<theSubMesh.FaceList.size(); ++i)
 	{
@@ -284,9 +284,11 @@ void OgreImporter::ReadSubMesh(SubMesh &theSubMesh, XmlReader *Reader)
 			UniqueUvs[3*i+2]=theSubMesh.Uvs[Vertex3];
 		}
 
-		UniqueWeights[3*i+0]=theSubMesh.Weights[Vertex1];
-		UniqueWeights[3*i+1]=theSubMesh.Weights[Vertex2];
-		UniqueWeights[3*i+2]=theSubMesh.Weights[Vertex3];
+		if (theSubMesh.Weights.size()) {
+			UniqueWeights[3*i+0]=theSubMesh.Weights[Vertex1];
+			UniqueWeights[3*i+1]=theSubMesh.Weights[Vertex2];
+			UniqueWeights[3*i+2]=theSubMesh.Weights[Vertex3];
+		}
 
 		//The indexvalues a just continuous numbers (0, 1, 2, 3, 4, 5, 6...)
 		UniqueFaceList[i].VertexIndices[0]=3*i+0;
@@ -370,8 +372,12 @@ void OgreImporter::CreateAssimpSubMesh(const SubMesh& theSubMesh, const vector<B
 		}
 	}
 	NewAiMesh->mNumBones=aiBones.size();
-	NewAiMesh->mBones=new aiBone* [aiBones.size()];
-	memcpy(NewAiMesh->mBones, &(aiBones[0]), aiBones.size()*sizeof(aiBone*));
+	
+	// mBones must be NULL if mNumBones is non 0 or the validation fails.
+	if (aiBones.size()) {
+		NewAiMesh->mBones=new aiBone* [aiBones.size()];
+		memcpy(NewAiMesh->mBones, &(aiBones[0]), aiBones.size()*sizeof(aiBone*));
+	}
 
 	//______________________________________________________________________________________________________