2
0
Эх сурвалжийг харах

Fix a fuzz test heap buffer overflow in mdl material loader (#5658)

Co-authored-by: Kim Kulling <[email protected]>
Stoyan Gaydarov 1 жил өмнө
parent
commit
5d5e0bad3c

+ 2 - 0
code/AssetLib/MDL/MDLMaterialLoader.cpp

@@ -730,10 +730,12 @@ void MDLImporter::SkipSkinLump_3DGS_MDL7(
     // if an ASCII effect description (HLSL?) is contained in the file,
     // if an ASCII effect description (HLSL?) is contained in the file,
     // we can simply ignore it ...
     // we can simply ignore it ...
     if (iType & AI_MDL7_SKINTYPE_MATERIAL_ASCDEF) {
     if (iType & AI_MDL7_SKINTYPE_MATERIAL_ASCDEF) {
+        VALIDATE_FILE_SIZE(szCurrent + sizeof(int32_t));
         int32_t iMe = 0;
         int32_t iMe = 0;
         ::memcpy(&iMe, szCurrent, sizeof(int32_t));
         ::memcpy(&iMe, szCurrent, sizeof(int32_t));
         AI_SWAP4(iMe);
         AI_SWAP4(iMe);
         szCurrent += sizeof(char) * iMe + sizeof(int32_t);
         szCurrent += sizeof(char) * iMe + sizeof(int32_t);
+        VALIDATE_FILE_SIZE(szCurrent);
     }
     }
     *szCurrentOut = szCurrent;
     *szCurrentOut = szCurrent;
 }
 }