chenlin/Mujoco_WASM
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix null pointer dereference in mj_loadModel.

Browse Source 
mj_makeModel returns NULL if any of the array sizes are negative. Callers of the function need to handle that case.

PiperOrigin-RevId: 457948558
Change-Id: I9a5c8c0d3293ed0a92c5791f00d3ed34c848e024
This commit is contained in:
Nimrod Gileadi
2022-06-29 05:09:22 -07:00
committed by Copybara-Service
parent 41bcf2d621
commit d567263959
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/engine/engine_io.c
+5 -1
View File
@@ -485,9 +485,13 @@ mjModel* mj_copyModel(mjModel* dest, const mjModel* src) {
src->nuser_cam, src->nuser_tendon, src->nuser_actuator, src->nuser_sensor, src->nuser_cam, src->nuser_tendon, src->nuser_actuator, src->nuser_sensor,
src->nnames); src->nnames);
} }
if (!dest) {
mju_error("Failed to make mjModel. Invalid sizes.");
}
// check sizes // check sizes
if (dest->nbuffer != src->nbuffer) { if (dest->nbuffer != src->nbuffer) {
mj_deleteModel(dest);
mju_error("dest and src models have different buffer size"); mju_error("dest and src models have different buffer size");
} }
@@ -649,7 +653,7 @@ mjModel* mj_loadModel(const char* filename, const mjVFS* vfs) {
info[28], info[29], info[30], info[31], info[32], info[33], info[34], info[28], info[29], info[30], info[31], info[32], info[33], info[34],
info[35], info[36], info[37], info[38], info[39], info[40], info[41], info[35], info[36], info[37], info[38], info[39], info[40], info[41],
info[42], info[43], info[44], info[45], info[46], info[47], info[48]); info[42], info[43], info[44], info[45], info[46], info[47], info[48]);
if (m->nbuffer!=info[getnint()-1]) { if (!m || m->nbuffer!=info[getnint()-1]) {
if (fp) { if (fp) {
fclose(fp); fclose(fp);
} }