Merge pull request #213 from dmuir/master

Validate model_length against length in LoadBinaryFromMemory.
This commit is contained in:
Syoyo Fujita 2019-10-29 02:20:31 +09:00 committed by GitHub
commit a11709a9ff
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -5618,6 +5618,7 @@ bool TinyGLTF::LoadBinaryFromMemory(Model *model, std::string *err,
// JSON contents,
// so use "greater than" operator.
if ((20 + model_length > size) || (model_length < 1) || (length > size) ||
(20 + model_length > length) ||
(model_format != 0x4E4F534A)) { // 0x4E4F534A = JSON format.
if (err) {
(*err) = "Invalid glTF binary.";