浏览代码

A fuzzed stride could cause the max count to become negative and hence wrap around uint (#5414)

Co-authored-by: Kim Kulling <[email protected]>
Florian Born 1 年之前
父节点
当前提交
76de7cedf4
共有 1 个文件被更改,包括 2 次插入2 次删除
  1. 2 2
      code/AssetLib/glTF2/glTF2Asset.inl

+ 2 - 2
code/AssetLib/glTF2/glTF2Asset.inl

@@ -1036,10 +1036,10 @@ size_t Accessor::ExtractData(T *&outData, const std::vector<unsigned int> *remap
     outData = new T[usedCount];
     outData = new T[usedCount];
 
 
     if (remappingIndices != nullptr) {
     if (remappingIndices != nullptr) {
-        const unsigned int maxIndex = static_cast<unsigned int>(maxSize / stride - 1);
+        const unsigned int maxIndexCount = static_cast<unsigned int>(maxSize / stride);
         for (size_t i = 0; i < usedCount; ++i) {
         for (size_t i = 0; i < usedCount; ++i) {
             size_t srcIdx = (*remappingIndices)[i];
             size_t srcIdx = (*remappingIndices)[i];
-            if (srcIdx > maxIndex) {
+            if (srcIdx >= maxIndexCount) {
                 throw DeadlyImportError("GLTF: index*stride ", (srcIdx * stride), " > maxSize ", maxSize, " in ", getContextForErrorMessages(id, name));
                 throw DeadlyImportError("GLTF: index*stride ", (srcIdx * stride), " > maxSize ", maxSize, " in ", getContextForErrorMessages(id, name));
             }
             }
             memcpy(outData + i, data + srcIdx * stride, elemSize);
             memcpy(outData + i, data + srcIdx * stride, elemSize);