GitHub-Proxy/tinygltf
1
0
Fork 0
mirror of https://git.mirrors.martin98.com/https://github.com/syoyo/tinygltf.git synced 2025-07-05 01:05:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix possible out of bounds index in LoadFromString

Browse Source
This commit is contained in:
Nirmal Patel 2022-09-06 09:16:31 -07:00 committed by GitHub
parent 4581d37bec
commit e413216722
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
tiny_gltf.h
View File

@ -5803,18 +5803,24 @@ bool TinyGLTF::LoadFromString(Model *model, std::string *err, std::string *warn,
} }
for (auto &attribute : primitive.attributes) { for (auto &attribute : primitive.attributes) {
model const auto accessorsIndex = size_t(attribute.second);
->bufferViews[size_t( if (accessorsIndex < model->accessors.size()) {
model->accessors[size_t(attribute.second)].bufferView)] const auto bufferView = model->accessors[accessorsIndex].bufferView;
.target = TINYGLTF_TARGET_ARRAY_BUFFER; // bufferView could be null(-1) for sparse morph target
if (bufferView >= 0 && bufferView < model->bufferViews.size()) {
model->bufferViews[size_t(bufferView)].target =
TINYGLTF_TARGET_ARRAY_BUFFER;
}
}
} }
for (auto &target : primitive.targets) { for (auto &target : primitive.targets) {
for (auto &attribute : target) { for (auto &attribute : target) {
auto bufferView = const auto accessorsIndex = size_t(attribute.second);
model->accessors[size_t(attribute.second)].bufferView; if (accessorsIndex < model->accessors.size()) {
const auto bufferView = model->accessors[accessorsIndex].bufferView;
// bufferView could be null(-1) for sparse morph target // bufferView could be null(-1) for sparse morph target
if (bufferView >= 0) { if (bufferView >= 0 && bufferView < model->bufferViews.size()) {
model->bufferViews[size_t(bufferView)].target = model->bufferViews[size_t(bufferView)].target =
TINYGLTF_TARGET_ARRAY_BUFFER; TINYGLTF_TARGET_ARRAY_BUFFER;
} }
@ -5822,6 +5828,7 @@ bool TinyGLTF::LoadFromString(Model *model, std::string *err, std::string *warn,
} }
} }
} }
}
// 7. Parse Node // 7. Parse Node
{ {