From 17318b02cf75b7fe5098c2c331780d5f9d4802c7 Mon Sep 17 00:00:00 2001
From: peng <mapengyuan@xfusion.com>
Date: Fri, 9 Jan 2026 15:59:22 +0800
Subject: [PATCH] MDC: Fix heap OOB read by validating vertex buffer boundaries
 (#6168) (#6438)

- Add explicit boundary checks for pcVerts and pcCVerts arrays in MDCImporter.
- Prevents heap out-of-bounds reads with malformed or truncated files.
- Fixes CVE-2025-5166.

Signed-off-by: mapengyuan <mapengyuan@xfusion.com>
---
 code/AssetLib/MDC/MDCLoader.cpp | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/code/AssetLib/MDC/MDCLoader.cpp b/code/AssetLib/MDC/MDCLoader.cpp
index abb063d4f..20e6b4272 100644
--- a/code/AssetLib/MDC/MDCLoader.cpp
+++ b/code/AssetLib/MDC/MDCLoader.cpp
@@ -324,6 +324,15 @@ void MDCImporter::InternReadFile(
 
 #endif
 
+        // boundary check for pcVerts
+        auto surfStart = reinterpret_cast<const uint8_t*>(pcSurface);
+        const uint8_t* surfEnd = surfStart + pcSurface->ulOffsetEnd;
+        auto vertBufStart = reinterpret_cast<const uint8_t*>(pcVerts);
+        const size_t needVertBytes = sizeof(MDC::BaseVertex) * pcSurface->ulNumVertices;
+        if (vertBufStart < surfStart || vertBufStart + needVertBytes > surfEnd) {
+            throw DeadlyImportError("MDCImporter: pcVerts points outside of surface block.");
+        }
+
         const MDC::CompressedVertex *pcCVerts = nullptr;
         int16_t *mdcCompVert = nullptr;
 
@@ -335,6 +344,12 @@ void MDCImporter::InternReadFile(
                 pcCVerts = (const MDC::CompressedVertex *)((int8_t *)pcSurface +
                                                            pcSurface->ulOffsetCompVerts) +
                            *mdcCompVert * pcSurface->ulNumVertices;
+                auto cvertBufStart = reinterpret_cast<const uint8_t*>(pcCVerts);
+                const size_t needCompVertBytes = sizeof(MDC::CompressedVertex) * pcSurface->ulNumVertices;
+                if (cvertBufStart < surfStart || cvertBufStart > surfEnd ||
+                    needCompVertBytes > static_cast<size_t>(surfEnd - cvertBufStart)) {
+                    throw DeadlyImportError("MDCImporter: pcCVerts points outside of surface block.");
+                }
             } else
                 mdcCompVert = nullptr;
         }