Scarfski/assimp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDC: Fix heap OOB read by validating vertex buffer boundaries (#6168) (#6438)

Browse Source 
- Add explicit boundary checks for pcVerts and pcCVerts arrays in MDCImporter.
- Prevents heap out-of-bounds reads with malformed or truncated files.
- Fixes CVE-2025-5166.

Signed-off-by: mapengyuan <mapengyuan@xfusion.com>
This commit is contained in:
peng
2026-01-09 15:59:22 +08:00
committed by GitHub
parent ac8eac60a5
commit 17318b02cf
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
code/AssetLib/MDC/MDCLoader.cpp
View File

@@ -324,6 +324,15 @@ void MDCImporter::InternReadFile(
#endif
// boundary check for pcVerts
auto surfStart = reinterpret_cast<const uint8_t*>(pcSurface);
const uint8_t* surfEnd = surfStart + pcSurface->ulOffsetEnd;
auto vertBufStart = reinterpret_cast<const uint8_t*>(pcVerts);
const size_t needVertBytes = sizeof(MDC::BaseVertex) * pcSurface->ulNumVertices;
if (vertBufStart < surfStart || vertBufStart + needVertBytes > surfEnd) {
throw DeadlyImportError("MDCImporter: pcVerts points outside of surface block.");
}
const MDC::CompressedVertex *pcCVerts = nullptr;
int16_t *mdcCompVert = nullptr;
@@ -335,6 +344,12 @@ void MDCImporter::InternReadFile(
pcCVerts = (const MDC::CompressedVertex *)((int8_t *)pcSurface +
pcSurface->ulOffsetCompVerts) +
*mdcCompVert * pcSurface->ulNumVertices;
auto cvertBufStart = reinterpret_cast<const uint8_t*>(pcCVerts);
const size_t needCompVertBytes = sizeof(MDC::CompressedVertex) * pcSurface->ulNumVertices;
if (cvertBufStart < surfStart || cvertBufStart > surfEnd ||
needCompVertBytes > static_cast<size_t>(surfEnd - cvertBufStart)) {
throw DeadlyImportError("MDCImporter: pcCVerts points outside of surface block.");
}
} else
mdcCompVert = nullptr;
}