瀏覽代碼

Fix overflow in IOStreamBuffer

`getNextLine` & `getNextDataLine` now double the buffer size each time
it is needed to avoid writing out of bounds.

Fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24465
Alex Rebert 3 年之前
父節點
當前提交
1909b3e8d2
共有 1 個文件被更改,包括 10 次插入0 次删除
  1. 10 0
      include/assimp/IOStreamBuffer.h

+ 10 - 0
include/assimp/IOStreamBuffer.h

@@ -261,6 +261,11 @@ AI_FORCE_INLINE bool IOStreamBuffer<T>::getNextDataLine(std::vector<T> &buffer,
         buffer[i] = m_cache[m_cachePos];
         buffer[i] = m_cache[m_cachePos];
         ++m_cachePos;
         ++m_cachePos;
         ++i;
         ++i;
+
+        if(i == buffer.size()) {
+            buffer.resize(buffer.size() * 2);
+        }
+
         if (m_cachePos >= size()) {
         if (m_cachePos >= size()) {
             break;
             break;
         }
         }
@@ -308,6 +313,11 @@ AI_FORCE_INLINE bool IOStreamBuffer<T>::getNextLine(std::vector<T> &buffer) {
         buffer[i] = m_cache[m_cachePos];
         buffer[i] = m_cache[m_cachePos];
         ++m_cachePos;
         ++m_cachePos;
         ++i;
         ++i;
+
+        if(i == buffer.size()) {
+            buffer.resize(buffer.size() * 2);
+        }
+
         if (m_cachePos >= m_cacheSize) {
         if (m_cachePos >= m_cacheSize) {
             if (!readNextBlock()) {
             if (!readNextBlock()) {
                 return false;
                 return false;