LWO: Fix heap buffer overflow in LWOImporter::GetS0 (#6451)

* LWO: Fix heap buffer overflow in LWOImporter::GetS0
* Add strict buffer boundary checks to prevent out-of-bounds reads on malformed or unterminated strings.
Fixes #6169 (CVE-2025-5167)
This commit is contained in:
peng
2026-02-03 19:21:06 +01:00
committed by GitHub
parent 18798f150d
commit 5c5ae38934
2 changed files with 70 additions and 89 deletions
+2 -25
View File
@@ -64,7 +64,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
using namespace Assimp;
static const aiImporterDesc desc = {
static constexpr aiImporterDesc desc = {
"LightWave/Modo Object Importer",
"",
"",
@@ -77,30 +77,6 @@ static const aiImporterDesc desc = {
"lwo lxo"
};
// ------------------------------------------------------------------------------------------------
// Constructor to be privately used by Importer
LWOImporter::LWOImporter() :
mIsLWO2(),
mIsLXOB(),
mIsLWO3(),
mLayers(),
mCurLayer(),
mTags(),
mMapping(),
mSurfaces(),
mFileBuffer(),
fileSize(),
mScene(nullptr),
configSpeedFlag(),
configLayerIndex(),
hasNamedLayer() {
// empty
}
// ------------------------------------------------------------------------------------------------
// Destructor, private as well
LWOImporter::~LWOImporter() = default;
// ------------------------------------------------------------------------------------------------
// Returns whether the class can handle the format of the given file.
bool LWOImporter::CanRead(const std::string &file, IOSystem *pIOHandler, bool /*checkSig*/) const {
@@ -155,6 +131,7 @@ void LWOImporter::InternReadFile(const std::string &pFile,
}
mFileBuffer = &mBuffer[0] + 12;
mFileBufferEnd = &mBuffer[0] + fileSize;
fileSize -= 12;
// Initialize some members with their default values