From 3a0ee8792fadfac04745c9612e862264660e81af Mon Sep 17 00:00:00 2001
From: Kyungjoon Ko <kj2648@naver.com>
Date: Thu, 14 Aug 2025 03:51:07 -0700
Subject: [PATCH] Fix OOB read (2) in OpenDDLParser::parsePrimitiveDataType
 (#6316)

Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
---
 contrib/openddlparser/code/OpenDDLParser.cpp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/contrib/openddlparser/code/OpenDDLParser.cpp b/contrib/openddlparser/code/OpenDDLParser.cpp
index 8529646a6..2f09d7bec 100644
--- a/contrib/openddlparser/code/OpenDDLParser.cpp
+++ b/contrib/openddlparser/code/OpenDDLParser.cpp
@@ -595,6 +595,9 @@ char *OpenDDLParser::parsePrimitiveDataType(char *in, char *end, Value::ValueTyp
     } else {
         in += prim_len;
     }
+    if (in >= end) {
+        return in;
+    }
 
     bool ok(true);
     if (*in == Grammar::OpenArrayToken[0]) {
@@ -602,13 +605,13 @@ char *OpenDDLParser::parsePrimitiveDataType(char *in, char *end, Value::ValueTyp
         ++in;
         char *start(in);
         while (in != end) {
-            ++in;
             if (*in == Grammar::CloseArrayToken[0]) {
                 len = ::atoi(start);
                 ok = true;
                 ++in;
                 break;
             }
+            ++in;
         }
     } else {
         len = 1;