Engine/lib/assimp/code/AssetLib/Q3D/Q3DLoader.cpp:
Q3DImporter::InternReadFile reads attacker-controlled 32-bit texture
mWidth and mHeight, then computes `unsigned int mul = mWidth * mHeight`
and allocates `new aiTexel[mul]`. The pre-existing check only rejects
zero dimensions, so a crafted .q3o/.q3s file can make the product
overflow 32 bits and wrap to a small value, yielding an undersized
allocation. The subsequent fill loop bounded by
`end = &begin[mul - 1] + 1` then writes far past the buffer
(mul-1 underflows when mul wraps to 0), an out-of-bounds heap write.
Add the integer-overflow guard from upstream assimp (the fix that
closed assimp/assimp#6358 / CVE-2025-11277) verbatim: after the
zero check, reject dimensions whose product would overflow before
the multiplication, throwing DeadlyImportError instead.
Refs #1765
fa8dd7decc