Scarfski/assimp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix AC3DImporter heap-buffer-overflow by validating mesh vertex bounds (#6458)

Browse Source 
Add validations check in AC3DImporter::ConvertObjectSection to ensure that writing TriangleStrip vertex data does not exceed mesh->mNumVertices allocation.
Fixes #6015 (CVE-2025-2754)
Fixes #6018 (CVE-2025-2756)

Signed-off-by: mapengyuan <mapengyuan@xfusion.com>
This commit is contained in:
peng
2026-01-29 04:33:55 +08:00
committed by GitHub
parent e0b52347c6
commit ae6633ef8a
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
code/AssetLib/AC/ACLoader.cpp
View File

@@ -607,6 +607,10 @@ aiNode *AC3DImporter::ConvertObjectSection(Object &object,
const Surface::SurfaceEntry &entry1 = src.entries[i];
const Surface::SurfaceEntry &entry2 = src.entries[i + 1];
const Surface::SurfaceEntry &entry3 = src.entries[i + 2];
const unsigned int verticesNeeded = isDoubleSided ? 6 : 3;
if (static_cast<unsigned>(vertices - mesh->mVertices) + verticesNeeded > mesh->mNumVertices) {
throw DeadlyImportError("AC3D: Invalid number of vertices");
}
aiFace &face = *faces++;
face.mNumIndices = 3;
@@ -661,6 +665,10 @@ aiNode *AC3DImporter::ConvertObjectSection(Object &object,
unsigned int tmp = (unsigned int)(*it).entries.size();
if (Surface::OpenLine == type) --tmp;
for (unsigned int m = 0; m < tmp; ++m) {
if (static_cast<unsigned>(vertices - mesh->mVertices) + 2 > mesh->mNumVertices) {
throw DeadlyImportError("AC3D: Invalid number of vertices");
}
aiFace &face = *faces++;
face.mNumIndices = 2;