Fix read past end of buffer on malformed LWOB files

2015-01-27 23:47:22 +02:00
parent 16f9ca35d2
commit 0108d5b1f9
1 changed files with 8 additions and 0 deletions
--- a/code/LWOBLoader.cpp
+++ b/code/LWOBLoader.cpp
@@ -139,7 +139,15 @@ void LWOImporter::CountVertsAndFacesLWOB(unsigned int& verts, unsigned int& face
 	while (cursor < end && max--)
 	{
 		uint16_t numIndices;
+		// must have 2 shorts left for numIndices and surface
+		if (end - cursor < 2) {
+			throw DeadlyImportError("LWOB: Unexpected end of file");
+		}
 		::memcpy(&numIndices, cursor++, 2);
+		// must have enough left for indices and surface
+		if (end - cursor < (1 + numIndices)) {
+			throw DeadlyImportError("LWOB: Unexpected end of file");
+		}
 		verts += numIndices;
 		faces++;
 		cursor += numIndices;