From 0d672efa905412ecc5beda33dad2124bd8890480 Mon Sep 17 00:00:00 2001 From: Max Vollmer Date: Wed, 29 Jan 2020 15:04:26 +0000 Subject: [PATCH 1/2] Check input token length before copy --- code/FBX/FBXParser.cpp | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/code/FBX/FBXParser.cpp b/code/FBX/FBXParser.cpp index 215ff7484..5486fdcc6 100644 --- a/code/FBX/FBXParser.cpp +++ b/code/FBX/FBXParser.cpp @@ -367,9 +367,12 @@ float ParseTokenAsFloat(const Token& t, const char*& err_out) // first - next in the fbx token stream comes ',', // which fast_atof could interpret as decimal point. #define MAX_FLOAT_LENGTH 31 - char temp[MAX_FLOAT_LENGTH + 1]; const size_t length = static_cast(t.end()-t.begin()); - std::copy(t.begin(),t.end(),temp); + if (length > MAX_FLOAT_LENGTH) + return 0.f; + + char temp[MAX_FLOAT_LENGTH + 1]; + std::copy(t.begin(), t.end(), temp); temp[std::min(static_cast(MAX_FLOAT_LENGTH),length)] = '\0'; return fast_atof(temp); From 58990d4e3ff84906b459164c211ce379fe63751c Mon Sep 17 00:00:00 2001 From: Kim Kulling Date: Mon, 10 Feb 2020 23:59:52 +0100 Subject: [PATCH 2/2] Update FBXParser.cpp add missing brackets. --- code/FBX/FBXParser.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/code/FBX/FBXParser.cpp b/code/FBX/FBXParser.cpp index 5486fdcc6..aef59d60c 100644 --- a/code/FBX/FBXParser.cpp +++ b/code/FBX/FBXParser.cpp @@ -368,8 +368,9 @@ float ParseTokenAsFloat(const Token& t, const char*& err_out) // which fast_atof could interpret as decimal point. #define MAX_FLOAT_LENGTH 31 const size_t length = static_cast(t.end()-t.begin()); - if (length > MAX_FLOAT_LENGTH) + if (length > MAX_FLOAT_LENGTH) { return 0.f; + } char temp[MAX_FLOAT_LENGTH + 1]; std::copy(t.begin(), t.end(), temp);