From 685d2b83c5381a59db0a1ffc0880a2d64ed8bd29 Mon Sep 17 00:00:00 2001 From: aramis_acg Date: Wed, 14 Apr 2010 21:45:00 +0000 Subject: [PATCH] Fix error in aiString documentation. MAXLEN includes the terminal NULL. This is unusual, but true. Fix overflow vulnerability in SceneCombiner. Thanks to Krishty to point it out. git-svn-id: https://assimp.svn.sourceforge.net/svnroot/assimp/trunk@683 67173fc5-114c-0410-ac8e-9d2fd5bffc1f --- code/SceneCombiner.cpp | 6 ++++++ include/aiTypes.h | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/code/SceneCombiner.cpp b/code/SceneCombiner.cpp index 34e834543..49494240b 100644 --- a/code/SceneCombiner.cpp +++ b/code/SceneCombiner.cpp @@ -62,6 +62,12 @@ inline void PrefixString(aiString& string,const char* prefix, unsigned int len) if (string.length >= 1 && string.data[0] == '$') return; + if (len+string.length>=MAXLEN-1) { + DefaultLogger::get()->debug("Can't add an unique prefix because the string is too long"); + ai_assert(false); + return; + } + // Add the prefix ::memmove(string.data+len,string.data,string.length+1); ::memcpy (string.data, prefix, len); diff --git a/include/aiTypes.h b/include/aiTypes.h index 4a49a179b..9103aa8e8 100644 --- a/include/aiTypes.h +++ b/include/aiTypes.h @@ -230,7 +230,8 @@ struct aiColor3D * UTF-8 strings to their working character set (i.e. MBCS, WideChar). * * We use this representation instead of std::string to be C-compatible. The - * (binary) length of such a string is limited to MAXLEN characters (excluding the 0). + * (binary) length of such a string is limited to MAXLEN characters (including the + * the terminating zero). */ struct aiString {