From e4132167222efec26ba012e7481dd067a6e23cb0 Mon Sep 17 00:00:00 2001 From: Nirmal Patel Date: Tue, 6 Sep 2022 09:16:31 -0700 Subject: [PATCH] Fix possible out of bounds index in LoadFromString --- tiny_gltf.h | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/tiny_gltf.h b/tiny_gltf.h index 174dbfc..8a4554b 100644 --- a/tiny_gltf.h +++ b/tiny_gltf.h @@ -5803,20 +5803,27 @@ bool TinyGLTF::LoadFromString(Model *model, std::string *err, std::string *warn, } for (auto &attribute : primitive.attributes) { - model - ->bufferViews[size_t( - model->accessors[size_t(attribute.second)].bufferView)] - .target = TINYGLTF_TARGET_ARRAY_BUFFER; + const auto accessorsIndex = size_t(attribute.second); + if (accessorsIndex < model->accessors.size()) { + const auto bufferView = model->accessors[accessorsIndex].bufferView; + // bufferView could be null(-1) for sparse morph target + if (bufferView >= 0 && bufferView < model->bufferViews.size()) { + model->bufferViews[size_t(bufferView)].target = + TINYGLTF_TARGET_ARRAY_BUFFER; + } + } } for (auto &target : primitive.targets) { for (auto &attribute : target) { - auto bufferView = - model->accessors[size_t(attribute.second)].bufferView; - // bufferView could be null(-1) for sparse morph target - if (bufferView >= 0) { - model->bufferViews[size_t(bufferView)].target = - TINYGLTF_TARGET_ARRAY_BUFFER; + const auto accessorsIndex = size_t(attribute.second); + if (accessorsIndex < model->accessors.size()) { + const auto bufferView = model->accessors[accessorsIndex].bufferView; + // bufferView could be null(-1) for sparse morph target + if (bufferView >= 0 && bufferView < model->bufferViews.size()) { + model->bufferViews[size_t(bufferView)].target = + TINYGLTF_TARGET_ARRAY_BUFFER; + } } } }