From ed89a02fff7f5392783a06020f8bef93c079cf7c Mon Sep 17 00:00:00 2001
From: Martin Mirchev <martin.mirchev@sonarsource.com>
Date: Fri, 16 May 2025 15:07:04 +0800
Subject: [PATCH] Fix out-of-bounds dereferencing (#6150)

* Fix out-of-bounds dereferencing

* Fix: Add log error entry.

---------

Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
---
 code/AssetLib/FBX/FBXExporter.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/code/AssetLib/FBX/FBXExporter.cpp b/code/AssetLib/FBX/FBXExporter.cpp
index 4b7986a75..7fb839c4e 100644
--- a/code/AssetLib/FBX/FBXExporter.cpp
+++ b/code/AssetLib/FBX/FBXExporter.cpp
@@ -51,6 +51,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #include <assimp/IOSystem.hpp>
 #include <assimp/Exporter.hpp>
 #include <assimp/DefaultLogger.hpp>
+#include <assimp/Logger.hpp>
 #include <assimp/StreamWriter.h> // StreamWriterLE
 #include <assimp/Exceptional.h> // DeadlyExportError
 #include <assimp/material.h> // aiTextureType
@@ -2039,7 +2040,11 @@ void FBXExporter::WriteObjects () {
                 std::vector<double> subdef_weights;
                 int32_t last_index = -1;
                 for (size_t wi = 0; wi < b->mNumWeights; ++wi) {
-                    int32_t vi = vVertexIndice[mi][b->mWeights[wi].mVertexId] \
+                    if (b->mWeights[wi].mVertexId >= vVertexIndice[mi].size()) {
+			ASSIMP_LOG_ERROR("UNREAL: Skipping vertex index to prevent buffer overflow.");
+                        continue;
+                    }
+                    int32_t vi = vVertexIndice[mi][b->mWeights[wi].mVertexId]
                       + uniq_v_before_mi[mi];
                     bool bIsWeightedAlready = (setWeightedVertex.find(vi) != setWeightedVertex.end());
                     if (vi == last_index || bIsWeightedAlready) {