Fix Heap-buffer-overflow in Q3DImporter::InternReadFile (#6370)

Checks if multiplying texture width and height would overflow before
performing the operation. This avoids incorrect memory allocations and
potential crashes with very large textures.

Fixes #6358

Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
This commit is contained in:
Jan Grulich
2025-11-04 10:09:13 +01:00
committed by GitHub
parent 8e35cb1a9f
commit 0978918f71

View File

@@ -55,6 +55,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#include <assimp/DefaultLogger.hpp>
#include <assimp/IOSystem.hpp>
#include <limits>
namespace Assimp {
static constexpr aiImporterDesc desc = {
@@ -309,6 +311,11 @@ void Q3DImporter::InternReadFile(const std::string &pFile,
throw DeadlyImportError("Quick3D: Invalid texture. Width or height is zero");
}
const unsigned int uint_max = std::numeric_limits<unsigned int>::max();
if (tex->mWidth > (uint_max / tex->mHeight)) {
throw DeadlyImportError("Quick3D: Texture dimensions are too large, resulting in overflow.");
}
unsigned int mul = tex->mWidth * tex->mHeight;
aiTexel *begin = tex->pcData = new aiTexel[mul];
aiTexel *const end = &begin[mul - 1] + 1;