LWO: Fix heap buffer overflow in LWOImporter::GetS0 (#6451)
* LWO: Fix heap buffer overflow in LWOImporter::GetS0 * Add strict buffer boundary checks to prevent out-of-bounds reads on malformed or unterminated strings. Fixes #6169 (CVE-2025-5167)
This commit is contained in:
@@ -64,7 +64,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
using namespace Assimp;
|
||||
|
||||
static const aiImporterDesc desc = {
|
||||
static constexpr aiImporterDesc desc = {
|
||||
"LightWave/Modo Object Importer",
|
||||
"",
|
||||
"",
|
||||
@@ -77,30 +77,6 @@ static const aiImporterDesc desc = {
|
||||
"lwo lxo"
|
||||
};
|
||||
|
||||
// ------------------------------------------------------------------------------------------------
|
||||
// Constructor to be privately used by Importer
|
||||
LWOImporter::LWOImporter() :
|
||||
mIsLWO2(),
|
||||
mIsLXOB(),
|
||||
mIsLWO3(),
|
||||
mLayers(),
|
||||
mCurLayer(),
|
||||
mTags(),
|
||||
mMapping(),
|
||||
mSurfaces(),
|
||||
mFileBuffer(),
|
||||
fileSize(),
|
||||
mScene(nullptr),
|
||||
configSpeedFlag(),
|
||||
configLayerIndex(),
|
||||
hasNamedLayer() {
|
||||
// empty
|
||||
}
|
||||
|
||||
// ------------------------------------------------------------------------------------------------
|
||||
// Destructor, private as well
|
||||
LWOImporter::~LWOImporter() = default;
|
||||
|
||||
// ------------------------------------------------------------------------------------------------
|
||||
// Returns whether the class can handle the format of the given file.
|
||||
bool LWOImporter::CanRead(const std::string &file, IOSystem *pIOHandler, bool /*checkSig*/) const {
|
||||
@@ -155,6 +131,7 @@ void LWOImporter::InternReadFile(const std::string &pFile,
|
||||
}
|
||||
|
||||
mFileBuffer = &mBuffer[0] + 12;
|
||||
mFileBufferEnd = &mBuffer[0] + fileSize;
|
||||
fileSize -= 12;
|
||||
|
||||
// Initialize some members with their default values
|
||||
|
||||
Reference in New Issue
Block a user