BRNSystems/irrlicht
1
0
Fork 0
forked from Mirrorlandia_minetest/irrlicht
Code Pull Requests Activity

Fix buffer overflow in COBJMeshFileLoader

Browse Source
This commit is contained in:
sfan5 2022-10-24 11:07:51 +02:00
parent d6766fb8f4
commit cac4e62852
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
source/Irrlicht/COBJMeshFileLoader.cpp
View File

@ -526,13 +526,18 @@ const c8* COBJMeshFileLoader::goAndCopyNextWord(c8* outBuf, const c8* inBuf, u32
bool COBJMeshFileLoader::retrieveVertexIndices(c8* vertexData, s32* idx, const c8* bufEnd, u32 vbsize, u32 vtsize, u32 vnsize) bool COBJMeshFileLoader::retrieveVertexIndices(c8* vertexData, s32* idx, const c8* bufEnd, u32 vbsize, u32 vtsize, u32 vnsize)
{ {
c8 word[16] = ""; const u32 BUFFER_LENGTH = 16;
c8 word[BUFFER_LENGTH];
const c8* p = goFirstWord(vertexData, bufEnd); const c8* p = goFirstWord(vertexData, bufEnd);
u32 idxType = 0; // 0 = posIdx, 1 = texcoordIdx, 2 = normalIdx u32 idxType = 0; // 0 = posIdx, 1 = texcoordIdx, 2 = normalIdx
u32 i = 0; u32 i = 0;
while ( p != bufEnd ) while ( p != bufEnd )
{ {
if ( i >= BUFFER_LENGTH )
{
return false;
}
if ( ( core::isdigit(*p)) || (*p == '-') ) if ( ( core::isdigit(*p)) || (*p == '-') )
{ {
// build up the number // build up the number