Procházet zdrojové kódy

Fix memory corruption when LWO file contains bad-sized points chunk

Turo Lamminen před 10 roky
rodič
revize
af09e68654
1 změnil soubory, kde provedl 5 přidání a 0 odebrání
  1. 5 0
      code/LWOLoader.cpp

+ 5 - 0
code/LWOLoader.cpp

@@ -730,6 +730,11 @@ void LWOImporter::LoadLWOPoints(unsigned int length)
 	// --- this function is used for both LWO2 and LWOB but for
 	// --- this function is used for both LWO2 and LWOB but for
 	// LWO2 we need to allocate 25% more storage - it could be we'll 
 	// LWO2 we need to allocate 25% more storage - it could be we'll 
 	// need to duplicate some points later.
 	// need to duplicate some points later.
+	const size_t vertexLen = 12;
+	if ((length % vertexLen) != 0)
+	{
+		throw DeadlyImportError( "LWO2: Points chunk length is not multiple of vertexLen (12)");
+	}
 	register unsigned int regularSize = (unsigned int)mCurLayer->mTempPoints.size() + length / 12;
 	register unsigned int regularSize = (unsigned int)mCurLayer->mTempPoints.size() + length / 12;
 	if (mIsLWO2)
 	if (mIsLWO2)
 	{
 	{