diff --git a/code/MD2Loader.cpp b/code/MD2Loader.cpp index 5e73d89fa..74af02467 100644 --- a/code/MD2Loader.cpp +++ b/code/MD2Loader.cpp @@ -189,10 +189,13 @@ void MD2Importer::ValidateHeader( ) throw DeadlyImportError("Invalid MD2 header: too many frames, would overflow"); } + // -1 because Frame already contains one + unsigned int frameSize = sizeof (MD2::Frame) + (m_pcHeader->numVertices - 1) * sizeof(MD2::Vertex); + if (m_pcHeader->offsetSkins + m_pcHeader->numSkins * sizeof (MD2::Skin) >= fileSize || m_pcHeader->offsetTexCoords + m_pcHeader->numTexCoords * sizeof (MD2::TexCoord) >= fileSize || m_pcHeader->offsetTriangles + m_pcHeader->numTriangles * sizeof (MD2::Triangle) >= fileSize || - m_pcHeader->offsetFrames + m_pcHeader->numFrames * sizeof (MD2::Frame) >= fileSize || + m_pcHeader->offsetFrames + m_pcHeader->numFrames * frameSize >= fileSize || m_pcHeader->offsetEnd > fileSize) { throw DeadlyImportError("Invalid MD2 header: some offsets are outside the file");