Scarfski/assimp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

NDO: Fix possible overflow access (#6055)

Browse Source 
* NDO: Fix possible overflow access
- closes https://issues.oss-fuzz.com/issues/372765427

---------

Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
This commit is contained in:
Zhang Yuntong
2025-03-25 04:21:32 +08:00
committed by GitHub
parent e2ee7d2c71
commit d307c9f1d7
1 changed files with 31 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
code/AssetLib/NDO/NDOLoader.cpp
View File

@@ -91,6 +91,36 @@ void NDOImporter::SetupProperties(const Importer* /*pImp*/)
// nothing to be done for the moment
}
// ------------------------------------------------------------------------------------------------
// Helper function to process edges and vertices for a face
void ProcessFaceEdgesAndVertices(const NDOImporter::Object& obj,
unsigned int start_edge, unsigned int key,
std::vector<aiVector3D>& vertices, std::vector<unsigned int>& indices)
{
unsigned int cur_edge = start_edge;
do {
unsigned int next_edge, next_vert;
if (key == obj.edges[cur_edge].edge[3]) {
next_edge = obj.edges[cur_edge].edge[5];
next_vert = obj.edges[cur_edge].edge[1];
}
else {
next_edge = obj.edges[cur_edge].edge[4];
next_vert = obj.edges[cur_edge].edge[0];
}
indices.push_back( static_cast<unsigned int>(vertices.size()) );
if (next_vert < obj.vertices.size()) {
vertices.push_back(obj.vertices[ next_vert ].val);
}
else {
ASSIMP_LOG_WARN("NDOImporter: next_vert is out of bounds, skipping invalid access.");
break;
}
cur_edge = next_edge;
} while (cur_edge != start_edge);
}
// ------------------------------------------------------------------------------------------------
// Imports the given file into the given scene structure.
void NDOImporter::InternReadFile( const std::string& pFile,
@@ -262,26 +292,7 @@ void NDOImporter::InternReadFile( const std::string& pFile,
aiFace& f = *faces++;
const unsigned int key = v.first;
unsigned int cur_edge = v.second;
while (true) {
unsigned int next_edge, next_vert;
if (key == obj.edges[cur_edge].edge[3]) {
next_edge = obj.edges[cur_edge].edge[5];
next_vert = obj.edges[cur_edge].edge[1];
}
else {
next_edge = obj.edges[cur_edge].edge[4];
next_vert = obj.edges[cur_edge].edge[0];
}
indices.push_back( static_cast<unsigned int>(vertices.size()) );
vertices.push_back(obj.vertices[ next_vert ].val);
cur_edge = next_edge;
if (cur_edge == v.second) {
break;
}
}
ProcessFaceEdgesAndVertices(obj, v.second, v.first, vertices, indices);
f.mIndices = new unsigned int[f.mNumIndices = static_cast<unsigned int>(indices.size())];
std::copy(indices.begin(),indices.end(),f.mIndices);