luanti-org/irrlicht-archive
Archived
1
0
Fork 0
Code Activity

Merging r6522 through r6546 from branch releases/1.8 to trunk

Browse Source 
- Fixing buffer overflows in bmp and obj loaders
- Fixed loading of rle4 encoded bmp images


git-svn-id: svn://svn.code.sf.net/p/irrlicht/code/trunk@6547 dfc29bdd-3216-0410-991c-e03cc46cb475
This commit is contained in:
cutealien
2023-10-02 21:42:40 +00:00
parent cd70803500
commit 5a6e8c9d65
3 changed files with 177 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
source/Irrlicht/COBJMeshFileLoader.cpp
View File

@@ -67,13 +67,25 @@ IAnimatedMesh* COBJMeshFileLoader::createMesh(io::IReadFile* file)
{
if (!file)
return 0;
long filesize = file->getSize();
if (!filesize)
return 0;
const io::path fullName = file->getFileName();
const io::path relPath = FileSystem->getFileDir(fullName)+"/";
c8* buf = new c8[filesize];
filesize = file->read((void*)buf, filesize);
if ( filesize <= 0 )
{
delete[] buf;
return 0;
}
if ( getMeshTextureLoader() )
getMeshTextureLoader()->setMeshFile(file);
const long filesize = file->getSize();
if (!filesize)
return 0;
const c8* const bufEnd = buf+filesize;
const u32 WORD_BUFFER_LENGTH = 512;
@@ -85,14 +97,6 @@ IAnimatedMesh* COBJMeshFileLoader::createMesh(io::IReadFile* file)
Materials.push_back(currMtl);
u32 smoothingGroup=0;
const io::path fullName = file->getFileName();
const io::path relPath = FileSystem->getFileDir(fullName)+"/";
c8* buf = new c8[filesize];
memset(buf, 0, filesize);
file->read((void*)buf, filesize);
const c8* const bufEnd = buf+filesize;
// Process obj information
const c8* bufPtr = buf;
core::stringc grpName, mtlName;
@@ -245,7 +249,7 @@ IAnimatedMesh* COBJMeshFileLoader::createMesh(io::IReadFile* file)
u32 wlength = copyWord(vertexWord, linePtr, WORD_BUFFER_LENGTH, endPtr);
// this function will also convert obj's 1-based index to c++'s 0-based index
retrieveVertexIndices(vertexWord, Idx, vertexWord+wlength+1, vertexBuffer.size(), textureCoordBuffer.size(), normalsBuffer.size());
if ( -1 != Idx[0] && Idx[0] < (irr::s32)vertexBuffer.size() )
if ( Idx[0] >= 0 && Idx[0] < (irr::s32)vertexBuffer.size() )
v.Pos = vertexBuffer[Idx[0]];
else
{
@@ -253,11 +257,11 @@ IAnimatedMesh* COBJMeshFileLoader::createMesh(io::IReadFile* file)
delete [] buf;
return 0;
}
if ( -1 != Idx[1] && Idx[1] < (irr::s32)textureCoordBuffer.size() )
if ( Idx[1] >= 0 && Idx[1] < (irr::s32)textureCoordBuffer.size() )
v.TCoords = textureCoordBuffer[Idx[1]];
else
v.TCoords.set(0.0f,0.0f);
if ( -1 != Idx[2] && Idx[2] < (irr::s32)normalsBuffer.size() )
if ( Idx[2] >= 0 && Idx[2] < (irr::s32)normalsBuffer.size() )
v.Normal = normalsBuffer[Idx[2]];
else
{
@@ -285,23 +289,30 @@ IAnimatedMesh* COBJMeshFileLoader::createMesh(io::IReadFile* file)
}
// triangulate the face
const int c = faceCorners[0];
for ( u32 i = 1; i < faceCorners.size() - 1; ++i )
if ( faceCorners.size() >= 3)
{
// Add a triangle
const int a = faceCorners[i + 1];
const int b = faceCorners[i];
if (a != b && a != c && b != c) // ignore degenerated faces. We can get them when we merge vertices above in the VertMap.
const int c = faceCorners[0];
for ( u32 i = 1; i < faceCorners.size() - 1; ++i )
{
mbIndexBuffer.push_back(a);
mbIndexBuffer.push_back(b);
mbIndexBuffer.push_back(c);
}
else
{
++degeneratedFaces;
// Add a triangle
const int a = faceCorners[i + 1];
const int b = faceCorners[i];
if (a != b && a != c && b != c) // ignore degenerated faces. We can get them when we merge vertices above in the VertMap.
{
mbIndexBuffer.push_back(a);
mbIndexBuffer.push_back(b);
mbIndexBuffer.push_back(c);
}
else
{
++degeneratedFaces;
}
}
}
else
{
os::Printer::log("Too few vertices in this line", wordBuffer.c_str());
}
}
break;