fix-CVE-2025-3158: closes #6023 Fixes CVE-2025-3158: Heap-based Buffer Overflow in Assimp::LWO::AnimResolver::UpdateAnimRangeSetup (#6222)

- changed loop-condition to reflect the fact that m must be smaller than n

Co-authored-by: Vinz Spring <vinzs@amazon.de>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
This commit is contained in:
Vinz Spring
2025-06-08 14:02:04 +02:00
committed by GitHub
parent 269987085f
commit 357b5baabb

View File

@@ -212,7 +212,7 @@ void AnimResolver::UpdateAnimRangeSetup() {
unsigned int tt = 1;
for (const double tmp = delta * (num + 1); cur_minus <= tmp; cur_minus += delta, ++tt) {
m = (delta == tmp ? (*it).keys.begin() : n - (old_size + 1));
for (; m != n; --n) {
for (; m < n; --n) {
(*n).time -= cur_minus;
// offset repeat? add delta offset to key value