From 2f0675ac53d9fef9d6b80be4a7189704fd9aeff8 Mon Sep 17 00:00:00 2001
From: Turo Lamminen <turotl@gmail.com>
Date: Mon, 26 Jan 2015 13:27:48 +0200
Subject: [PATCH] Fix memory corruption when 3DS file has more smoothing groups
 than faces

---
 code/3DSLoader.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/code/3DSLoader.cpp b/code/3DSLoader.cpp
index 1f2235229..6a51fb84f 100644
--- a/code/3DSLoader.cpp
+++ b/code/3DSLoader.cpp
@@ -948,6 +948,9 @@ void Discreet3DSImporter::ParseFaceChunk()
 		// This is the list of smoothing groups - a bitfield for every face. 
 		// Up to 32 smoothing groups assigned to a single face.
 		unsigned int num = chunkSize/4, m = 0;
+		if (num > mMesh.mFaces.size())	{
+			throw DeadlyImportError("3DS: More smoothing groups than faces");
+		}
 		for (std::vector<D3DS::Face>::iterator i =  mMesh.mFaces.begin(); m != num;++i, ++m)	{
 			// nth bit is set for nth smoothing group
 			(*i).iSmoothGroup = stream->GetI4();