fix-CVE-2025-3158: closes #6023 Fixes CVE-2025-3158: Heap-based Buffer Overflow in Assimp::LWO::AnimResolver::UpdateAnimRangeSetup (#6222)
- changed loop-condition to reflect the fact that m must be smaller than n Co-authored-by: Vinz Spring <vinzs@amazon.de> Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
This commit is contained in:
@@ -212,7 +212,7 @@ void AnimResolver::UpdateAnimRangeSetup() {
|
||||
unsigned int tt = 1;
|
||||
for (const double tmp = delta * (num + 1); cur_minus <= tmp; cur_minus += delta, ++tt) {
|
||||
m = (delta == tmp ? (*it).keys.begin() : n - (old_size + 1));
|
||||
for (; m != n; --n) {
|
||||
for (; m < n; --n) {
|
||||
(*n).time -= cur_minus;
|
||||
|
||||
// offset repeat? add delta offset to key value
|
||||
|
||||
Reference in New Issue
Block a user