Merge pull request #3575 from ms-maxvollmer/gltf2_buffer_fixes

Fixes for GLTF2 buffers

code/AssetLib/glTF2/glTF2Asset.inl

@@ -560,18 +560,17 @@ inline void BufferView::Read(Value &obj, Asset &r) {
         buffer = r.buffers.Retrieve(bufferVal->GetUint());
     }
 
+    if (!buffer) {
+        throw DeadlyImportError("GLTF: Buffer view without valid buffer.");
+    }
+
     byteOffset = MemberOrDefault(obj, "byteOffset", size_t(0));
     byteLength = MemberOrDefault(obj, "byteLength", size_t(0));
     byteStride = MemberOrDefault(obj, "byteStride", 0u);
 
     // Check length
     if ((byteOffset + byteLength) > buffer->byteLength) {
-        const uint8_t val_size = 64;
-
-        char val[val_size];
-
-        ai_snprintf(val, val_size, "%llu, %llu", (unsigned long long)byteOffset, (unsigned long long)byteLength);
-        throw DeadlyImportError("GLTF: Buffer view with offset/length (", val, ") is out of range.");
+        throw DeadlyImportError("GLTF: Buffer view with offset/length (", byteOffset, "/", byteLength, ") is out of range.");
     }
 }
 
@@ -649,13 +648,14 @@ inline void Accessor::Read(Value &obj, Asset &r) {
     if (bufferView) {
         // Check length
         unsigned long long byteLength = (unsigned long long)GetBytesPerComponent() * (unsigned long long)count;
-        if ((byteOffset + byteLength) > bufferView->byteLength || (bufferView->byteOffset + byteOffset + byteLength) > bufferView->buffer->byteLength) {
-            const uint8_t val_size = 64;
 
-            char val[val_size];
+        // handle integer overflow
+        if (byteLength < count) {
+            throw DeadlyImportError("GLTF: Accessor with offset/count (", byteOffset, "/", count, ") is out of range.");
+        }
 
-            ai_snprintf(val, val_size, "%llu, %llu", (unsigned long long)byteOffset, (unsigned long long)byteLength);
-            throw DeadlyImportError("GLTF: Accessor with offset/length (", val, ") is out of range.");
+        if ((byteOffset + byteLength) > bufferView->byteLength || (bufferView->byteOffset + byteOffset + byteLength) > bufferView->buffer->byteLength) {
+            throw DeadlyImportError("GLTF: Accessor with offset/length (", byteOffset, "/", byteLength, ") is out of range.");
         }
     }