In `HL1MDLLoader::read_animations`, the arrays for `scene_->mAnimations`
and `scene_animation->mChannels` were allocated using `new T*[count]`.
This performs default initialization, which leaves the pointer elements
with indeterminate (garbage) values.
If an exception (such as a `DeadlyImportError` from malformed input) is
thrown during the loop populating these arrays, the `aiScene` or
`aiAnimation` destructors are invoked during stack unwinding. These
destructors iterate through the allocated arrays and call `delete` on
each element. Because the arrays contained garbage values for indices
not yet reached by the loader, the destructor attempted to delete
invalid memory addresses, leading to a segmentation fault.
This patch changes the allocations to use value-initialization (`new
T*[count]()`), ensuring all pointers are initialized to `nullptr`. Since
`delete nullptr` is a safe no-op, the destructors can now safely clean
up partially initialized objects during an exception.
Fixes: https://issues.oss-fuzz.com/issues/483188619
Co-authored-by: CodeMender <codemender-patching@google.com>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
Add buffer boundary checks before reading frame data to prevent out-of-bounds reads on malformed MDL files.
Fixes#6172 (CVE-2025-5200)
Signed-off-by: mapengyuan <mapengyuan@xfusion.com>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* Update copyright year and project version
- Fixes version in lib
* Update copyright year to 2026
* Update copyright year to 2026 in Version.cpp
* Update copyright year and version patch test
* Fix copyright year
* Adapt copyrights
The loader attempted to read the MDL header without verifying if the input buffer was large enough.
Added a check in MDLImporter::InternReadFile_HL1 to ensure the buffer size is sufficient before proceeding with loading.
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* Harmonize Importer #includes
Some importers referred to their headers via `#include "AssetLib/[format]/[header.h"`, others via `#include "[header].h"`, others mixed both (e.g. IRR). This is a matter of taste, but it should at least be done the same way everywhere.
Most importers seem to prefer `#include "[header].h"`, so this commit enforces it.
Cross-referencing files from other importers is still done through `AssetLib/[format]`.
Assimp headers are not affected and I would advise against changing them, as this could lead to subtle collisions with user includes.
* went one too far
---------
Co-authored-by: Krishty <krishty@krishty.com>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* Fix Whitespace
No functional changes. This commit removes trailing spaces, undesired line breaks, and formatting screwups.
* Remove more useless line breaks in license (500 out of 630 license copies do NOT use double line breaks here)
---------
Co-authored-by: Krishty <krishty@krishty.com>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* Make color single precision
* Fix the unittests for double precision
* Fix merge issues
* Fix issues with Vertex + Color4
* Fix vertex operator, some tests are still red.
