yquake2/yquake2remaster
0
0
Fork 0
mirror of https://github.com/yquake2/yquake2remaster.git synced 2025-02-02 05:52:15 +00:00
Code Issues Projects Releases Packages Wiki Activity

models: ReadMD5Model more strict validation

Browse source
This commit is contained in:
Denis Pauk 2024-03-03 23:40:54 +02:00
parent 994cf72a76
commit fac9a5ce5c
1 changed files with 38 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
src/client/refresh/files/models_md5.c
View file

@ -876,6 +876,17 @@ ReadMD5Model(const char *buffer, size_t size)
return NULL; return NULL;
} }
/* more meshes than originally provided */
if (curr_mesh >= mdl->num_meshes)
{
mdl->num_meshes = curr_mesh + 1;
/* Allocate memory for meshes */
mdl->meshes = (md5_mesh_t *)
realloc(mdl->meshes, mdl->num_meshes * sizeof(md5_mesh_t));
memset(mdl->meshes + curr_mesh, 0, sizeof(md5_mesh_t));
}
mesh = &mdl->meshes[curr_mesh]; mesh = &mdl->meshes[curr_mesh];
while (curr_buff) while (curr_buff)
@ -934,6 +945,15 @@ ReadMD5Model(const char *buffer, size_t size)
token = COM_Parse(&curr_buff); token = COM_Parse(&curr_buff);
index = (int)strtol(token, (char **)NULL, 10); index = (int)strtol(token, (char **)NULL, 10);
if (index >= mesh->num_verts)
{
R_Printf(PRINT_ALL, "Error: incorrect vert index\n");
FreeModelMd5(mdl);
free(safe_buffer);
return NULL;
}
/* Copy vertex data */ /* Copy vertex data */
if (!ParseFloatBlock(&curr_buff, 2, mesh->vertices[index].st)) if (!ParseFloatBlock(&curr_buff, 2, mesh->vertices[index].st))
{ {
@ -956,6 +976,15 @@ ReadMD5Model(const char *buffer, size_t size)
token = COM_Parse(&curr_buff); token = COM_Parse(&curr_buff);
index = (int)strtol(token, (char **)NULL, 10); index = (int)strtol(token, (char **)NULL, 10);
if (index >= mesh->num_tris)
{
R_Printf(PRINT_ALL, "Error: incorrect tri index\n");
FreeModelMd5(mdl);
free(safe_buffer);
return NULL;
}
/* Copy triangle data */ /* Copy triangle data */
for (j = 0; j < 3; j++) for (j = 0; j < 3; j++)
{ {
@ -970,6 +999,15 @@ ReadMD5Model(const char *buffer, size_t size)
token = COM_Parse(&curr_buff); token = COM_Parse(&curr_buff);
index = (int)strtol(token, (char **)NULL, 10); index = (int)strtol(token, (char **)NULL, 10);
if (index >= mesh->num_weights)
{
R_Printf(PRINT_ALL, "Error: incorrect weight index\n");
FreeModelMd5(mdl);
free(safe_buffer);
return NULL;
}
token = COM_Parse(&curr_buff); token = COM_Parse(&curr_buff);
mesh->weights[index].joint = (int)strtol(token, (char **)NULL, 10); mesh->weights[index].joint = (int)strtol(token, (char **)NULL, 10);