From 760816ae18116e8b4325df74275b90b66e95e0c5 Mon Sep 17 00:00:00 2001 From: Nimrod Gileadi Date: Thu, 4 Aug 2022 12:46:40 -0700 Subject: [PATCH] Make sure the size of items on the model / data buffer is never negative. Explicitly check that nmocap won't cause overflow when multiplied by 4, to give a nicer error message. PiperOrigin-RevId: 465380712 Change-Id: I217e3759d55e9761b47db5efd892b8bc811ea8ae --- src/engine/engine_io.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/engine/engine_io.c b/src/engine/engine_io.c index 255adfa2..883d21b6 100644 --- a/src/engine/engine_io.c +++ b/src/engine/engine_io.c @@ -15,6 +15,7 @@ #include "engine/engine_io.h" +#include #include #include #include @@ -361,6 +362,9 @@ static void mj_setPtrModel(mjModel* m) { // *nbuffer += SKIP(*offset) + type_size*nr*nc; // *offset += SKIP(*offset) + type_size*nr*nc; static int safeAddToBufferSize(intptr_t* offset, int* nbuffer, size_t type_size, int nr, int nc) { + if (type_size < 0 || nr < 0 || nc < 0) { + return 0; + } #if (__has_builtin(__builtin_add_overflow) && __has_builtin(__builtin_mul_overflow)) \ || (defined(__GNUC__) && __GNUC__ >= 5) // supported by GCC and Clang @@ -469,6 +473,13 @@ mjModel* mj_makeModel(int nq, int nv, int nu, int na, int nbody, int njnt, return 0; } + // nmocap is going to get multiplied by 4, and shouldn't overflow + if (m->nmocap >= INT_MAX / 4) { + mju_warning("Invalid model: nmocap too large"); + mj_deleteModel(m); + return 0; + } + // compute buffer size m->nbuffer = 0; #define X(type, name, nr, nc) \