Merging r6274 through r6276 from branch releases/1.8 to trunk

- Security fix for md2 loader


git-svn-id: svn://svn.code.sf.net/p/irrlicht/code/trunk@6277 dfc29bdd-3216-0410-991c-e03cc46cb475
This commit is contained in:
cutealien 2022-01-02 20:15:24 +00:00
parent e7c7e36347
commit dadbf64a8c

@ -152,9 +152,9 @@ bool CMD2MeshFileLoader::loadFile(io::IReadFile* file, CAnimatedMeshMD2* mesh)
}
const int MAX_FRAME_SIZE = MD2_MAX_VERTS*4+128;
if ( header.frameSize > MAX_FRAME_SIZE )
if ( header.frameSize > MAX_FRAME_SIZE || header.frameSize < 0)
{
os::Printer::log("MD2 Loader: Invalid large frame size in header", file->getFileName(), ELL_WARNING);
os::Printer::log("MD2 Loader: Invalid frame size in header", file->getFileName(), ELL_WARNING);
return false;
}