소스 검색

Fix out-of-bounds dereferencing (#6150)

* Fix out-of-bounds dereferencing

* Fix: Add log error entry.

---------

Co-authored-by: Kim Kulling <[email protected]>
Martin Mirchev 2 달 전
부모
커밋
ed89a02fff
1개의 변경된 파일6개의 추가작업 그리고 1개의 파일을 삭제
  1. 6 1
      code/AssetLib/FBX/FBXExporter.cpp

+ 6 - 1
code/AssetLib/FBX/FBXExporter.cpp

@@ -51,6 +51,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #include <assimp/IOSystem.hpp>
 #include <assimp/Exporter.hpp>
 #include <assimp/DefaultLogger.hpp>
+#include <assimp/Logger.hpp>
 #include <assimp/StreamWriter.h> // StreamWriterLE
 #include <assimp/Exceptional.h> // DeadlyExportError
 #include <assimp/material.h> // aiTextureType
@@ -2039,7 +2040,11 @@ void FBXExporter::WriteObjects () {
                 std::vector<double> subdef_weights;
                 int32_t last_index = -1;
                 for (size_t wi = 0; wi < b->mNumWeights; ++wi) {
-                    int32_t vi = vVertexIndice[mi][b->mWeights[wi].mVertexId] \
+                    if (b->mWeights[wi].mVertexId >= vVertexIndice[mi].size()) {
+			ASSIMP_LOG_ERROR("UNREAL: Skipping vertex index to prevent buffer overflow.");
+                        continue;
+                    }
+                    int32_t vi = vVertexIndice[mi][b->mWeights[wi].mVertexId]
                       + uniq_v_before_mi[mi];
                     bool bIsWeightedAlready = (setWeightedVertex.find(vi) != setWeightedVertex.end());
                     if (vi == last_index || bIsWeightedAlready) {