chenlin/Mujoco_WASM
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix integer overflow in MSH loading

Browse Source 
PiperOrigin-RevId: 621151576
Change-Id: I33f44dcc5d1099502714b384d97c37fe95e72186
This commit is contained in:
Nimrod Gileadi
2024-04-02 06:10:36 -07:00
committed by Copybara-Service
parent 827b7a2792
commit 02a7a8dc11
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/user/user_mesh.cc
+7
View File
@@ -13,6 +13,7 @@
// limitations under the License. // limitations under the License.
#include <algorithm> #include <algorithm>
#include <climits>
#include <cmath> #include <cmath>
#include <csetjmp> #include <csetjmp>
#include <cstddef> #include <cstddef>
@@ -1293,6 +1294,12 @@ void mjCMesh::LoadMSH(mjResource* resource) {
throw mjCError(this, "invalid sizes in MSH file '%s'", resource->name); throw mjCError(this, "invalid sizes in MSH file '%s'", resource->name);
} }
if (nvert_ >= INT_MAX / sizeof(float) / 3 ||
nnormal_ >= INT_MAX / sizeof(float) / 3 ||
ntexcoord_ >= INT_MAX / sizeof(float) / 2 ||
nface_ >= INT_MAX / sizeof(int) / 3) {
throw mjCError(this, "too large sizes in MSH file '%s'.", resource->name);
}
// check file size // check file size
if (buffer_sz != 4*sizeof(int) + 3*nvert_*sizeof(float) + 3*nnormal_*sizeof(float) + if (buffer_sz != 4*sizeof(int) + 3*nvert_*sizeof(float) + 3*nnormal_*sizeof(float) +
2*ntexcoord_*sizeof(float) + 3*nface_*sizeof(int)) { 2*ntexcoord_*sizeof(float) + 3*nface_*sizeof(int)) {