浏览代码

Fixes Heap-buffer-overflow READ 1 in Assimp::MD5::MD5Parser::ParseHeader

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49422
When it reaches the `SkipSpacesAndLineEnd`, `in` already points past `bufferEnd` and it leads to out of bounds memory read.
Alex 2 年之前
父节点
当前提交
90769ef3e6
共有 1 个文件被更改,包括 2 次插入0 次删除
  1. 2 0
      code/AssetLib/MD5/MD5Parser.cpp

+ 2 - 0
code/AssetLib/MD5/MD5Parser.cpp

@@ -117,6 +117,8 @@ void MD5Parser::ParseHeader() {
         ReportError("MD5 version tag is unknown (10 is expected)");
     }
     SkipLine();
+    if (buffer == bufferEnd)
+        return;
 
     // print the command line options to the console
     // FIX: can break the log length limit, so we need to be careful