Browse Source

Merge pull request #4644 from sashashura/patch-2

Fixes Heap-use-after-free in Assimp::DXFImporter::ExpandBlockReferences
Kim Kulling 3 years ago
parent
commit
3c253ca3e5
1 changed files with 3 additions and 1 deletions
  1. 3 1
      code/AssetLib/DXF/DXFLoader.cpp

+ 3 - 1
code/AssetLib/DXF/DXFLoader.cpp

@@ -368,7 +368,9 @@ void DXFImporter::ExpandBlockReferences(DXF::Block& bl,const DXF::BlockMap& bloc
         // XXX this would be the place to implement recursive expansion if needed.
         // XXX this would be the place to implement recursive expansion if needed.
         const DXF::Block& bl_src = *(*it).second;
         const DXF::Block& bl_src = *(*it).second;
 
 
-        for (std::shared_ptr<const DXF::PolyLine> pl_in : bl_src.lines) {
+        const size_t size = bl_src.lines.size(); // the size may increase in the loop
+        for (size_t i = 0; i < size; ++i) {
+            std::shared_ptr<const DXF::PolyLine> pl_in = bl_src.lines[i];
             if (!pl_in) {
             if (!pl_in) {
                 ASSIMP_LOG_ERROR("DXF: PolyLine instance is nullptr, skipping.");
                 ASSIMP_LOG_ERROR("DXF: PolyLine instance is nullptr, skipping.");
                 continue;
                 continue;