From 02a7a8dc11d9cf061a5638096d589e051e6a9a79 Mon Sep 17 00:00:00 2001
From: Nimrod Gileadi <nimrod@google.com>
Date: Tue, 2 Apr 2024 06:10:36 -0700
Subject: [PATCH] Fix integer overflow in MSH loading

PiperOrigin-RevId: 621151576
Change-Id: I33f44dcc5d1099502714b384d97c37fe95e72186
---
 src/user/user_mesh.cc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/user/user_mesh.cc b/src/user/user_mesh.cc
index cfed0213..1ffadf6c 100644
--- a/src/user/user_mesh.cc
+++ b/src/user/user_mesh.cc
@@ -13,6 +13,7 @@
 // limitations under the License.
 
 #include <algorithm>
+#include <climits>
 #include <cmath>
 #include <csetjmp>
 #include <cstddef>
@@ -1293,6 +1294,12 @@ void mjCMesh::LoadMSH(mjResource* resource) {
     throw mjCError(this, "invalid sizes in MSH file '%s'", resource->name);
   }
 
+  if (nvert_ >= INT_MAX / sizeof(float) / 3 ||
+      nnormal_ >= INT_MAX / sizeof(float) / 3 ||
+      ntexcoord_ >= INT_MAX / sizeof(float) / 2 ||
+      nface_ >= INT_MAX / sizeof(int) / 3) {
+    throw mjCError(this, "too large sizes in MSH file '%s'.", resource->name);
+  }
   // check file size
   if (buffer_sz != 4*sizeof(int) + 3*nvert_*sizeof(float) + 3*nnormal_*sizeof(float) +
       2*ntexcoord_*sizeof(float) + 3*nface_*sizeof(int)) {