From 357b5baabbd0af01cbe712c6506ee1d06d2da8de Mon Sep 17 00:00:00 2001 From: Vinz Spring Date: Sun, 8 Jun 2025 14:02:04 +0200 Subject: [PATCH] fix-CVE-2025-3158: closes #6023 Fixes CVE-2025-3158: Heap-based Buffer Overflow in Assimp::LWO::AnimResolver::UpdateAnimRangeSetup (#6222) - changed loop-condition to reflect the fact that m must be smaller than n Co-authored-by: Vinz Spring Co-authored-by: Kim Kulling --- code/AssetLib/LWO/LWOAnimation.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code/AssetLib/LWO/LWOAnimation.cpp b/code/AssetLib/LWO/LWOAnimation.cpp index 432dc4cab..f6cfd6a85 100644 --- a/code/AssetLib/LWO/LWOAnimation.cpp +++ b/code/AssetLib/LWO/LWOAnimation.cpp @@ -212,7 +212,7 @@ void AnimResolver::UpdateAnimRangeSetup() { unsigned int tt = 1; for (const double tmp = delta * (num + 1); cur_minus <= tmp; cur_minus += delta, ++tt) { m = (delta == tmp ? (*it).keys.begin() : n - (old_size + 1)); - for (; m != n; --n) { + for (; m < n; --n) { (*n).time -= cur_minus; // offset repeat? add delta offset to key value