Added check to avoid accessing pointer past the end of the string.

openscenegraph · Mar 30, 2012 · 347556e · 347556e
1 parent 24c9ed8
commit 347556e
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/src/osgPlugins/OpenFlight/PaletteRecords.cpp b/src/osgPlugins/OpenFlight/PaletteRecords.cpp
@@ -66,11 +66,14 @@ class VertexPalette : public Record
         uint32 paletteSize = in.readUInt32();
 
         // Entries in vertex pool found by offset from start of this record.
-        const int RECORD_HEADER_SIZE = 4;
-        const int OFFSET = RECORD_HEADER_SIZE+sizeof(paletteSize);
+        const uint32 RECORD_HEADER_SIZE = 4;
+        const uint32 OFFSET = RECORD_HEADER_SIZE+sizeof(paletteSize);
 
         std::string buffer(paletteSize,'\0');
-        in.read(&buffer[OFFSET], paletteSize-OFFSET);
+        if (OFFSET < paletteSize)
+        {
+            in.read(&buffer[OFFSET], paletteSize-OFFSET);
+        }
 
         // Keep a copy of the vertex pool in memory for later reference.
         document.setVertexPool(new VertexPool(buffer));