Validate that fields like mjModel.body_jntnum don't contain negative values.

PiperOrigin-RevId: 466733848 Change-Id: I0b1f41fa8841c678307f2185aac4c46a2fd40396
2022-08-10 10:56:58 -07:00
parent e3ded23c66
commit 01c297cddd
2 changed files with 31 additions and 1 deletions
@@ -1282,7 +1282,11 @@ const char* mj_validateReferences(const mjModel* m) {
    int *nums = (numarray);                                   \
    for (int i=0; i<m->nadrs; i++) {                          \
      int adrsmin = m->adrarray[i];                           \
-      int adrsmax = m->adrarray[i] + (nums ? nums[i] : 1);    \
+      int num = (nums ? nums[i] : 1);                         \
+      if (num < 0) {                                          \
+        return "Invalid model: " #numarray " is negative.";   \
+      }                                                       \
+      int adrsmax = m->adrarray[i] + num;                     \
      if (adrsmax > m->ntarget || adrsmin < -1) {             \
        return "Invalid model: " #adrarray " out of bounds."; \
      }                                                       \