Merge pull request #4211 from ms-maxvollmer/ms-maxvollmer/crashfixes2

Added checks for out of bounds data access/writing

code/AssetLib/glTF/glTFCommon.h

@@ -300,7 +300,7 @@ public:
 
     inline unsigned int GetIndex() const { return index; }
 
-    operator bool() const { return vector != 0; }
+    operator bool() const { return vector != nullptr && index < vector->size(); }
 
     T *operator->() { return (*vector)[index]; }
 

code/AssetLib/glTF2/glTF2Asset.inl

@@ -600,6 +600,10 @@ inline void Buffer::Read(Value &obj, Asset &r) {
 inline bool Buffer::LoadFromStream(IOStream &stream, size_t length, size_t baseOffset) {
     byteLength = length ? length : stream.FileSize();
 
+    if (byteLength > stream.FileSize()) {
+        throw DeadlyImportError("GLTF: Invalid byteLength exceeds size of actual data.");
+    }
+
     if (baseOffset) {
         stream.Seek(baseOffset, aiOrigin_SET);
     }

include/assimp/Vertex.h

@@ -135,7 +135,9 @@ public:
     /** Extract a particular vertex from a anim mesh and interleave all components */
     explicit Vertex(const aiAnimMesh* msh, unsigned int idx) {
         ai_assert(idx < msh->mNumVertices);
-        position = msh->mVertices[idx];
+        if (msh->HasPositions()) {
+            position = msh->mVertices[idx];
+        }
 
         if (msh->HasNormals()) {
             normal = msh->mNormals[idx];