From 65c95bf3207b81fe522811d45780d72ed41d9c1e Mon Sep 17 00:00:00 2001 From: Kim Kulling Date: Wed, 12 Mar 2025 20:17:38 +0100 Subject: [PATCH] ASE: Fix possible out of bound access. Upstream: https://github.com/assimp/assimp/pull/6045 CVE: CVE-2025-3015 Signed-off-by: Titouan Christophe --- code/AssetLib/ASE/ASELoader.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/code/AssetLib/ASE/ASELoader.cpp b/code/AssetLib/ASE/ASELoader.cpp index eb6b37dc9b..c63edcf6bf 100644 --- a/code/AssetLib/ASE/ASELoader.cpp +++ b/code/AssetLib/ASE/ASELoader.cpp @@ -731,6 +731,10 @@ void ASEImporter::BuildUniqueRepresentation(ASE::Mesh &mesh) { unsigned int iCurrent = 0, fi = 0; for (std::vector::iterator i = mesh.mFaces.begin(); i != mesh.mFaces.end(); ++i, ++fi) { for (unsigned int n = 0; n < 3; ++n, ++iCurrent) { + const uint32_t curIndex = (*i).mIndices[n]; + if (curIndex >= mesh.mPositions.size()) { + throw DeadlyImportError("ASE: Invalid vertex index in face ", fi, "."); + } mPositions[iCurrent] = mesh.mPositions[(*i).mIndices[n]]; // add texture coordinates