From 2eb86d75b86baff7c81b3dcb53de9a6c47dea5f8 Mon Sep 17 00:00:00 2001
From: Kim Kulling <kimkulling@users.noreply.github.com>
Date: Wed, 22 Dec 2021 19:45:19 +0100
Subject: [PATCH 1/3] Make sure no overflow can happen

- During UTF32 LE with BOM make sure that the byteswap operation will have enough space when iterating through the text buffer, which shall get encoded.
- closes https://github.com/assimp/assimp/issues/4230
---
 code/Common/BaseImporter.cpp | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/code/Common/BaseImporter.cpp b/code/Common/BaseImporter.cpp
index d7e24afab..c0a87b632 100644
--- a/code/Common/BaseImporter.cpp
+++ b/code/Common/BaseImporter.cpp
@@ -65,6 +65,7 @@ using namespace Assimp;
 // Constructor to be privately used by Importer
 BaseImporter::BaseImporter() AI_NO_EXCEPT
         : m_progress() {
+    // empty
 }
 
 // ------------------------------------------------------------------------------------------------
@@ -371,11 +372,16 @@ void BaseImporter::ConvertToUTF8(std::vector<char> &data) {
     }
 
     // UTF 16 BE with BOM
+    size_t index = 0;
     if (*((uint16_t *)&data.front()) == 0xFFFE) {
-
         // swap the endianness ..
         for (uint16_t *p = (uint16_t *)&data.front(), *end = (uint16_t *)&data.back(); p <= end; ++p) {
-            ByteSwap::Swap2(p);
+            // Check to ensure no overflow can happen
+            if ((index+2) < data.Size()) {
+                // Swap the data
+                ByteSwap::Swap2(p);
+                index += 2;
+            }
         }
     }
 

From 215f4e1f4dcca57f1dee9f18519df1af659ad62c Mon Sep 17 00:00:00 2001
From: Kim Kulling <kimkulling@users.noreply.github.com>
Date: Wed, 22 Dec 2021 20:02:29 +0100
Subject: [PATCH 2/3] Fix typo

---
 code/Common/BaseImporter.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/code/Common/BaseImporter.cpp b/code/Common/BaseImporter.cpp
index c0a87b632..570ba7f7b 100644
--- a/code/Common/BaseImporter.cpp
+++ b/code/Common/BaseImporter.cpp
@@ -377,7 +377,7 @@ void BaseImporter::ConvertToUTF8(std::vector<char> &data) {
         // swap the endianness ..
         for (uint16_t *p = (uint16_t *)&data.front(), *end = (uint16_t *)&data.back(); p <= end; ++p) {
             // Check to ensure no overflow can happen
-            if ((index+2) < data.Size()) {
+            if ((index+2) < data.size()) {
                 // Swap the data
                 ByteSwap::Swap2(p);
                 index += 2;

From 2c66d4d3a2c7b9b6c74f38c8a4ef847f4e624740 Mon Sep 17 00:00:00 2001
From: Kim Kulling <kimkulling@users.noreply.github.com>
Date: Wed, 22 Dec 2021 20:43:44 +0100
Subject: [PATCH 3/3] Optimize the check

---
 code/Common/BaseImporter.cpp | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/code/Common/BaseImporter.cpp b/code/Common/BaseImporter.cpp
index 570ba7f7b..82b8f12fc 100644
--- a/code/Common/BaseImporter.cpp
+++ b/code/Common/BaseImporter.cpp
@@ -372,16 +372,14 @@ void BaseImporter::ConvertToUTF8(std::vector<char> &data) {
     }
 
     // UTF 16 BE with BOM
-    size_t index = 0;
     if (*((uint16_t *)&data.front()) == 0xFFFE) {
+        // Check to ensure no overflow can happen
+        if(data.size() % 2 != 0) {
+            return;
+        }
         // swap the endianness ..
         for (uint16_t *p = (uint16_t *)&data.front(), *end = (uint16_t *)&data.back(); p <= end; ++p) {
-            // Check to ensure no overflow can happen
-            if ((index+2) < data.size()) {
-                // Swap the data
-                ByteSwap::Swap2(p);
-                index += 2;
-            }
+            ByteSwap::Swap2(p);
         }
     }