浏览代码

Fixes Heap-use-after-free in Assimp::DXFImporter::ExpandBlockReferences

sashashura 3 年之前
父节点
当前提交
a4274930e4
共有 1 个文件被更改,包括 3 次插入1 次删除
  1. 3 1
      code/AssetLib/DXF/DXFLoader.cpp

+ 3 - 1
code/AssetLib/DXF/DXFLoader.cpp

@@ -368,7 +368,9 @@ void DXFImporter::ExpandBlockReferences(DXF::Block& bl,const DXF::BlockMap& bloc
         // XXX this would be the place to implement recursive expansion if needed.
         // XXX this would be the place to implement recursive expansion if needed.
         const DXF::Block& bl_src = *(*it).second;
         const DXF::Block& bl_src = *(*it).second;
 
 
-        for (std::shared_ptr<const DXF::PolyLine> pl_in : bl_src.lines) {
+        const size_t size = bl_src.lines.size(); // the size may increase in the loop
+        for (size_t i = 0; i < size; ++i) {
+            std::shared_ptr<const DXF::PolyLine> pl_in = bl_src.lines[i];
             if (!pl_in) {
             if (!pl_in) {
                 ASSIMP_LOG_ERROR("DXF: PolyLine instance is nullptr, skipping.");
                 ASSIMP_LOG_ERROR("DXF: PolyLine instance is nullptr, skipping.");
                 continue;
                 continue;