From 00fcd10b201df480fe2cce4f11d84b175acf92d9 Mon Sep 17 00:00:00 2001
From: Nimrod Gileadi <nimrod@google.com>
Date: Wed, 24 Aug 2022 03:53:50 -0700
Subject: [PATCH] Don't use user input as a format string in mjCError.

PiperOrigin-RevId: 469686222
Change-Id: Icb05df04f11387847aa8d66dcf1b63da9c470b9f
---
 src/user/user_mesh.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/user/user_mesh.cc b/src/user/user_mesh.cc
index b7e726a8..81f11723 100644
--- a/src/user/user_mesh.cc
+++ b/src/user/user_mesh.cc
@@ -540,7 +540,7 @@ void mjCMesh::LoadOBJ(const mjVFS* vfs) {
     std::stringstream msg;
     msg << "could not parse OBJ file '" << filename << "': \n"
         << objReader.Error();
-    throw mjCError(this, msg.str().c_str());
+    throw mjCError(this, "%s", msg.str().c_str());
   }
 
   auto attrib = objReader.GetAttrib();