Merge branch 'master' into kimkulling/update-security

code/AssetLib/CSM/CSMLoader.cpp

@@ -176,9 +176,17 @@ void CSMImporter::InternReadFile( const std::string& pFile,
                 // If we know how many frames we'll read, we can preallocate some storage
                 unsigned int alloc = 100;
                 if (last != 0x00ffffff) {
+                    // re-init if the file has last frame data
                     alloc = last-first;
                     alloc += alloc>>2u; // + 25%
                     for (unsigned int i = 0; i < anim->mNumChannels; ++i) {
+                        if (anim->mChannels[i]->mPositionKeys != nullptr) delete[] anim->mChannels[i]->mPositionKeys;
+                        anim->mChannels[i]->mPositionKeys = new aiVectorKey[alloc];
+                    }
+                } else {
+                    // default init
+                    for (unsigned int i = 0; i < anim->mNumChannels; ++i) {
+                        if (anim->mChannels[i]->mPositionKeys != nullptr) continue;
                         anim->mChannels[i]->mPositionKeys = new aiVectorKey[alloc];
                     }
                 }
@@ -202,7 +210,7 @@ void CSMImporter::InternReadFile( const std::string& pFile,
                         if (s->mNumPositionKeys == alloc)   {
                             // need to reallocate?
                             aiVectorKey* old = s->mPositionKeys;
-                            s->mPositionKeys = new aiVectorKey[s->mNumPositionKeys = alloc*2];
+                            s->mPositionKeys = new aiVectorKey[alloc*2];
                             ::memcpy(s->mPositionKeys,old,sizeof(aiVectorKey)*alloc);
                             delete[] old;
                         }

code/AssetLib/LWO/LWOAnimation.cpp

@@ -212,7 +212,7 @@ void AnimResolver::UpdateAnimRangeSetup() {
             unsigned int tt = 1;
             for (const double tmp = delta * (num + 1); cur_minus <= tmp; cur_minus += delta, ++tt) {
                 m = (delta == tmp ? (*it).keys.begin() : n - (old_size + 1));
-                for (; m != n; --n) {
+                for (; m < n; --n) {
                     (*n).time -= cur_minus;
 
                     // offset repeat? add delta offset to key value

code/AssetLib/MD5/MD5Parser.cpp

@@ -277,6 +277,8 @@ inline bool AI_MD5_PARSE_STRING(const char **sz, const char *bufferEnd, aiString
         }
     }
     out.length = (ai_uint32)(szEnd - szStart);
+    if (out.length >= AI_MAXLEN)
+        out.length = AI_MAXLEN - 1;
     ::memcpy(out.data, szStart, out.length);
     out.data[out.length] = '\0';
 
@@ -299,6 +301,8 @@ inline void AI_MD5_PARSE_STRING_IN_QUOTATION(const char **sz, const char *buffer
             const char *szEnd = *sz;
             ++*sz;
             out.length = (ai_uint32)(szEnd - szStart);
+            if (out.length >= AI_MAXLEN)
+                out.length = AI_MAXLEN - 1;
             ::memcpy(out.data, szStart, out.length);
         }
     }