Browse Source

Fix overflow in IOStreamBuffer

`getNextLine` & `getNextDataLine` now double the buffer size each time
it is needed to avoid writing out of bounds.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24465
Alex Rebert 3 years ago
parent
commit
1909b3e8d2
1 changed files with 10 additions and 0 deletions
  1. 10 0
      include/assimp/IOStreamBuffer.h

+ 10 - 0
include/assimp/IOStreamBuffer.h

@@ -261,6 +261,11 @@ AI_FORCE_INLINE bool IOStreamBuffer<T>::getNextDataLine(std::vector<T> &buffer,
         buffer[i] = m_cache[m_cachePos];
         ++m_cachePos;
         ++i;
+
+        if(i == buffer.size()) {
+            buffer.resize(buffer.size() * 2);
+        }
+
         if (m_cachePos >= size()) {
             break;
         }
@@ -308,6 +313,11 @@ AI_FORCE_INLINE bool IOStreamBuffer<T>::getNextLine(std::vector<T> &buffer) {
         buffer[i] = m_cache[m_cachePos];
         ++m_cachePos;
         ++i;
+
+        if(i == buffer.size()) {
+            buffer.resize(buffer.size() * 2);
+        }
+
         if (m_cachePos >= m_cacheSize) {
             if (!readNextBlock()) {
                 return false;