From cd489fc72d28fb188d2ac64f56de99bf1fbd7a3b Mon Sep 17 00:00:00 2001
From: Alessio Quaglino <quaglino@google.com>
Date: Fri, 29 Jul 2022 04:13:25 -0700
Subject: [PATCH] Check if STL vertex coordinates are within maximum bounds.

PiperOrigin-RevId: 464047975
Change-Id: I5c8c32aca468aaee26ff5cf9466a0f2f81721010
---
 src/user/user_mesh.cc | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/user/user_mesh.cc b/src/user/user_mesh.cc
index 287748c6..eedc237b 100644
--- a/src/user/user_mesh.cc
+++ b/src/user/user_mesh.cc
@@ -688,6 +688,17 @@ void mjCMesh::LoadSTL(const mjVFS* vfs) {
       // get pointer to vertex coordiates
       float* v = (float*)(stl+50*i+12*(j+1));
 
+      // check if vertex coordinates can be cast to an int safely
+      if (fabs(v[0])>pow(2, 30) || fabs(v[1])>pow(2, 30) || fabs(v[2])>pow(2, 30)) {
+        if (!flag_existing) {
+          mju_free(buffer);
+        }
+
+        throw mjCError(this,
+                      "vertex coordinates in STL file '%s' exceed maximum bounds",
+                      filename.c_str());
+      }
+
       // add vertex address in face; change order if scale makes it lefthanded
       if (righthand || j==0) {
         face[3*i+j] = nvert;