Fix Heap-buffer-overflow in Q3DImporter::InternReadFile (#6370)
Checks if multiplying texture width and height would overflow before performing the operation. This avoids incorrect memory allocations and potential crashes with very large textures. Fixes #6358 Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
This commit is contained in:
@@ -55,6 +55,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
#include <assimp/DefaultLogger.hpp>
|
||||
#include <assimp/IOSystem.hpp>
|
||||
|
||||
#include <limits>
|
||||
|
||||
namespace Assimp {
|
||||
|
||||
static constexpr aiImporterDesc desc = {
|
||||
@@ -309,6 +311,11 @@ void Q3DImporter::InternReadFile(const std::string &pFile,
|
||||
throw DeadlyImportError("Quick3D: Invalid texture. Width or height is zero");
|
||||
}
|
||||
|
||||
const unsigned int uint_max = std::numeric_limits<unsigned int>::max();
|
||||
if (tex->mWidth > (uint_max / tex->mHeight)) {
|
||||
throw DeadlyImportError("Quick3D: Texture dimensions are too large, resulting in overflow.");
|
||||
}
|
||||
|
||||
unsigned int mul = tex->mWidth * tex->mHeight;
|
||||
aiTexel *begin = tex->pcData = new aiTexel[mul];
|
||||
aiTexel *const end = &begin[mul - 1] + 1;
|
||||
|
||||
Reference in New Issue
Block a user