Matthew Suozzo b2852bc49b glTF2: Fix heap-buffer-overflow in GetVertexColorsForType (#6558) ...

The `GetVertexColorsForType` function previously used `input->count`
(the total number of elements in the accessor) to allocate the output
array and bound the conversion loop. However, when a
`vertexRemappingTable` is provided, `ExtractData` extracts a subset of
elements matching the size of the remapping table rather than the full
accessor count.

In cases where the remapping table was smaller than the accessor count
(including empty tables), the subsequent loop would perform
out-of-bounds reads on the `colors` buffer allocated by `ExtractData`.

This fix captures the actual number of elements extracted by
`ExtractData` and uses this value for the output allocation and loop
iteration, ensuring memory safety when vertex remapping is active.

Verified with ASan and existing unit tests.

2026-03-11 15:53:34 +01:00

78 KiB

Raw Blame History

View Raw