30 lines
1.2 KiB
Diff
30 lines
1.2 KiB
Diff
From 65c95bf3207b81fe522811d45780d72ed41d9c1e Mon Sep 17 00:00:00 2001
|
|
From: Kim Kulling <kim.kulling@googlemail.com>
|
|
Date: Wed, 12 Mar 2025 20:17:38 +0100
|
|
Subject: [PATCH] ASE: Fix possible out of bound access.
|
|
|
|
Upstream: https://github.com/assimp/assimp/pull/6045
|
|
|
|
CVE: CVE-2025-3015
|
|
|
|
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
|
|
---
|
|
code/AssetLib/ASE/ASELoader.cpp | 4 ++++
|
|
1 file changed, 4 insertions(+)
|
|
|
|
diff --git a/code/AssetLib/ASE/ASELoader.cpp b/code/AssetLib/ASE/ASELoader.cpp
|
|
index eb6b37dc9b..c63edcf6bf 100644
|
|
--- a/code/AssetLib/ASE/ASELoader.cpp
|
|
+++ b/code/AssetLib/ASE/ASELoader.cpp
|
|
@@ -731,6 +731,10 @@ void ASEImporter::BuildUniqueRepresentation(ASE::Mesh &mesh) {
|
|
unsigned int iCurrent = 0, fi = 0;
|
|
for (std::vector<ASE::Face>::iterator i = mesh.mFaces.begin(); i != mesh.mFaces.end(); ++i, ++fi) {
|
|
for (unsigned int n = 0; n < 3; ++n, ++iCurrent) {
|
|
+ const uint32_t curIndex = (*i).mIndices[n];
|
|
+ if (curIndex >= mesh.mPositions.size()) {
|
|
+ throw DeadlyImportError("ASE: Invalid vertex index in face ", fi, ".");
|
|
+ }
|
|
mPositions[iCurrent] = mesh.mPositions[(*i).mIndices[n]];
|
|
|
|
// add texture coordinates
|