From 437b484070c074d575422436f3aa7a44df5457c8 Mon Sep 17 00:00:00 2001 From: tyler92 Date: Wed, 1 Jan 2025 18:40:18 +0200 Subject: [PATCH] Fix heap buffer overflow in HMP loader (#5939) --- code/AssetLib/HMP/HMPLoader.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/code/AssetLib/HMP/HMPLoader.cpp b/code/AssetLib/HMP/HMPLoader.cpp index 30931a920..b3398afff 100644 --- a/code/AssetLib/HMP/HMPLoader.cpp +++ b/code/AssetLib/HMP/HMPLoader.cpp @@ -163,8 +163,14 @@ void HMPImporter::ValidateHeader_HMP457() { "120 bytes, this file is smaller)"); } + if (!std::isfinite(pcHeader->ftrisize_x) || !std::isfinite(pcHeader->ftrisize_y)) + throw DeadlyImportError("Size of triangles in either x or y direction is not finite"); + if (!pcHeader->ftrisize_x || !pcHeader->ftrisize_y) - throw DeadlyImportError("Size of triangles in either x or y direction is zero"); + throw DeadlyImportError("Size of triangles in either x or y direction is zero"); + + if (!std::isfinite(pcHeader->fnumverts_x)) + throw DeadlyImportError("Number of triangles in x direction is not finite"); if (pcHeader->fnumverts_x < 1.0f || (pcHeader->numverts / pcHeader->fnumverts_x) < 1.0f) throw DeadlyImportError("Number of triangles in either x or y direction is zero");