浏览代码

Fix possible negative array access

- Return when the calculated offset gets negative
- closes https://github.com/assimp/assimp/issues/4414
Kim Kulling 3 年之前
父节点
当前提交
cf96639119
共有 1 个文件被更改,包括 5 次插入2 次删除
  1. 5 2
      include/assimp/Hash.h

+ 5 - 2
include/assimp/Hash.h

@@ -4,7 +4,6 @@ Open Asset Import Library (assimp)
 
 Copyright (c) 2006-2022, assimp team
 
-
 All rights reserved.
 
 Redistribution and use of this software in source and binary forms,
@@ -96,7 +95,11 @@ int rem;
     switch (rem) {
         case 3: hash += get16bits (data);
                 hash ^= hash << 16;
-                hash ^= data[sizeof (uint16_t)] << 18;
+                size_t offset = static_cast<size_t>(sizeof(uint16_t));
+                if (offset < 0) {
+                    return 0;
+                }
+                hash ^= data[offset] << 18;
                 hash += hash >> 11;
                 break;
         case 2: hash += get16bits (data);