From b0f453dba881d542e10dd67f4cadb74faf491263 Mon Sep 17 00:00:00 2001 From: Turo Lamminen Date: Sun, 13 Mar 2016 00:41:39 +0200 Subject: [PATCH] MD2: Check file is big enough to contain all the advertised frames --- code/MD2Loader.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/code/MD2Loader.cpp b/code/MD2Loader.cpp index 5e73d89fa..74af02467 100644 --- a/code/MD2Loader.cpp +++ b/code/MD2Loader.cpp @@ -189,10 +189,13 @@ void MD2Importer::ValidateHeader( ) throw DeadlyImportError("Invalid MD2 header: too many frames, would overflow"); } + // -1 because Frame already contains one + unsigned int frameSize = sizeof (MD2::Frame) + (m_pcHeader->numVertices - 1) * sizeof(MD2::Vertex); + if (m_pcHeader->offsetSkins + m_pcHeader->numSkins * sizeof (MD2::Skin) >= fileSize || m_pcHeader->offsetTexCoords + m_pcHeader->numTexCoords * sizeof (MD2::TexCoord) >= fileSize || m_pcHeader->offsetTriangles + m_pcHeader->numTriangles * sizeof (MD2::Triangle) >= fileSize || - m_pcHeader->offsetFrames + m_pcHeader->numFrames * sizeof (MD2::Frame) >= fileSize || + m_pcHeader->offsetFrames + m_pcHeader->numFrames * frameSize >= fileSize || m_pcHeader->offsetEnd > fileSize) { throw DeadlyImportError("Invalid MD2 header: some offsets are outside the file");