mirror of
https://github.com/TorqueGameEngines/Torque3D.git
synced 2026-07-03 18:54:28 +00:00
fa8dd7decc
Engine/lib/assimp/code/AssetLib/Q3D/Q3DLoader.cpp: Q3DImporter::InternReadFile reads attacker-controlled 32-bit texture mWidth and mHeight, then computes `unsigned int mul = mWidth * mHeight` and allocates `new aiTexel[mul]`. The pre-existing check only rejects zero dimensions, so a crafted .q3o/.q3s file can make the product overflow 32 bits and wrap to a small value, yielding an undersized allocation. The subsequent fill loop bounded by `end = &begin[mul - 1] + 1` then writes far past the buffer (mul-1 underflows when mul wraps to 0), an out-of-bounds heap write. Add the integer-overflow guard from upstream assimp (the fix that closed assimp/assimp#6358 / CVE-2025-11277) verbatim: after the zero check, reject dimensions whose product would overflow before the multiplication, throwing DeadlyImportError instead. Refs #1765 |
||
|---|---|---|
| .. | ||
| bin | ||
| lib | ||
| modules/Verve | ||
| source | ||
| CMakeLists.txt | ||