From d567263959245b0cecf1ea84eff3a347214ed25c Mon Sep 17 00:00:00 2001 From: Nimrod Gileadi Date: Wed, 29 Jun 2022 05:09:22 -0700 Subject: [PATCH] Fix null pointer dereference in mj_loadModel. mj_makeModel returns NULL if any of the array sizes are negative. Callers of the function need to handle that case. PiperOrigin-RevId: 457948558 Change-Id: I9a5c8c0d3293ed0a92c5791f00d3ed34c848e024 --- src/engine/engine_io.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/engine/engine_io.c b/src/engine/engine_io.c index 093a472f..41fe9372 100644 --- a/src/engine/engine_io.c +++ b/src/engine/engine_io.c @@ -485,9 +485,13 @@ mjModel* mj_copyModel(mjModel* dest, const mjModel* src) { src->nuser_cam, src->nuser_tendon, src->nuser_actuator, src->nuser_sensor, src->nnames); } + if (!dest) { + mju_error("Failed to make mjModel. Invalid sizes."); + } // check sizes if (dest->nbuffer != src->nbuffer) { + mj_deleteModel(dest); mju_error("dest and src models have different buffer size"); } @@ -649,7 +653,7 @@ mjModel* mj_loadModel(const char* filename, const mjVFS* vfs) { info[28], info[29], info[30], info[31], info[32], info[33], info[34], info[35], info[36], info[37], info[38], info[39], info[40], info[41], info[42], info[43], info[44], info[45], info[46], info[47], info[48]); - if (m->nbuffer!=info[getnint()-1]) { + if (!m || m->nbuffer!=info[getnint()-1]) { if (fp) { fclose(fp); }