minetest/irrlicht
1
0
Fork 0
mirror of https://github.com/minetest/irrlicht.git synced 2024-10-07 03:30:24 +02:00
Code Issues Projects Releases Wiki Activity

Merging r6270 from branch releases/1.8 to trunk

Browse Source 
- Prevent buffer overflow in md2 loader


git-svn-id: svn://svn.code.sf.net/p/irrlicht/code/trunk@6271 dfc29bdd-3216-0410-991c-e03cc46cb475
This commit is contained in:
cutealien 2021-12-12 13:55:03 +00:00
parent 73d562d745
commit 2bed22acbb
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
changes.txt
View File

@ -334,6 +334,7 @@ Changes in 1.9 (not yet released)
--------------------------
Changes in 1.8.6
- Security: Fix buffer overflow caused by malformed md2 files. Thanks @procfs for reporting (https://irrlicht.sourceforge.io/forum/viewtopic.php?f=7&t=52785)
- Makefile now only adds CFLAGS instead of overwriting them.
- Several spelling fixes (Patch #455). Thanks @J. Puydt

9
source/Irrlicht/CMD2MeshFileLoader.cpp
View File

@ -151,6 +151,13 @@ bool CMD2MeshFileLoader::loadFile(io::IReadFile* file, CAnimatedMeshMD2* mesh)
return false;
}
const int MAX_FRAME_SIZE = MD2_MAX_VERTS*4+128;
if ( header.frameSize > MAX_FRAME_SIZE )
{
os::Printer::log("MD2 Loader: Invalid large frame size in header", file->getFileName(), ELL_WARNING);
return false;
}
//
// prepare mesh and allocate memory
//
@ -232,7 +239,7 @@ bool CMD2MeshFileLoader::loadFile(io::IReadFile* file, CAnimatedMeshMD2* mesh)
// read Vertices
u8 buffer[MD2_MAX_VERTS*4+128];
u8 buffer[MAX_FRAME_SIZE];
SMD2Frame* frame = (SMD2Frame*)buffer;
file->seek(header.offsetFrames);