Merge pull request #5127 from sashashura/5921493454815232

Fix Bad-cast to Assimp::D3DS::Material from invalid vptr in Assimp::ASE::Parser::ParseLV2MaterialBlock
assimp · Jun 27, 2023 · d2411a7 · d2411a7
2 parents 8937248 + db6c1a8
commit d2411a7
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/code/AssetLib/ASE/ASEParser.cpp b/code/AssetLib/ASE/ASEParser.cpp
@@ -479,6 +479,11 @@ void Parser::ParseLV1MaterialListBlock() {
             if (TokenMatch(filePtr, "MATERIAL_COUNT", 14)) {
                 ParseLV4MeshLong(iMaterialCount);
 
+                if (UINT_MAX - iOldMaterialCount < iMaterialCount) {
+                    LogWarning("Out of range: material index is too large");
+                    return;
+                }
+
                 // now allocate enough storage to hold all materials
                 m_vMaterials.resize(iOldMaterialCount + iMaterialCount, Material("INVALID"));
                 continue;