54 lines
2.4 KiB
Diff
54 lines
2.4 KiB
Diff
From 18798f150d5baaccedca6a2d7ea343a252c948ee Mon Sep 17 00:00:00 2001
|
|
From: peng <mapengyuan@xfusion.com>
|
|
Date: Fri, 30 Jan 2026 04:10:18 +0800
|
|
Subject: [PATCH] MDL: Fix heap buffer overflow in MDLImporter frame parsing
|
|
(#6456)
|
|
|
|
Add buffer boundary checks before reading frame data to prevent out-of-bounds reads on malformed MDL files.
|
|
Fixes #6172 (CVE-2025-5200)
|
|
|
|
Signed-off-by: mapengyuan <mapengyuan@xfusion.com>
|
|
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
|
|
---
|
|
code/AssetLib/MDL/MDLLoader.cpp | 4 ++++
|
|
1 file changed, 4 insertions(+)
|
|
|
|
diff --git a/code/AssetLib/MDL/MDLLoader.cpp b/code/AssetLib/MDL/MDLLoader.cpp
|
|
index 9a0ae81d3..3a3dec955 100644
|
|
--- a/code/AssetLib/MDL/MDLLoader.cpp
|
|
+++ b/code/AssetLib/MDL/MDLLoader.cpp
|
|
@@ -450,12 +450,14 @@ void MDLImporter::InternReadFile_Quake1() {
|
|
BE_NCONST MDL::Frame *pcFrames = (BE_NCONST MDL::Frame *)szCurrent;
|
|
MDL::SimpleFrame *pcFirstFrame;
|
|
|
|
+ VALIDATE_FILE_SIZE((const unsigned char *)(pcFrames + 1));
|
|
if (0 == pcFrames->type) {
|
|
// get address of single frame
|
|
pcFirstFrame = (MDL::SimpleFrame *)&pcFrames->frame;
|
|
} else {
|
|
// get the first frame in the group
|
|
BE_NCONST MDL::GroupFrame *pcFrames2 = (BE_NCONST MDL::GroupFrame *)szCurrent;
|
|
+ VALIDATE_FILE_SIZE((const unsigned char *)(pcFrames2 + 1));
|
|
pcFirstFrame = (MDL::SimpleFrame *)( szCurrent + sizeof(MDL::GroupFrame::type) + sizeof(MDL::GroupFrame::numframes)
|
|
+ sizeof(MDL::GroupFrame::min) + sizeof(MDL::GroupFrame::max) + sizeof(*MDL::GroupFrame::times) * pcFrames2->numframes );
|
|
}
|
|
@@ -703,6 +705,7 @@ void MDLImporter::InternReadFile_3DGS_MDL345() {
|
|
|
|
// now get a pointer to the first frame in the file
|
|
BE_NCONST MDL::Frame *pcFrames = (BE_NCONST MDL::Frame *)szCurrent;
|
|
+ VALIDATE_FILE_SIZE((const unsigned char *)(pcFrames + 1));
|
|
AI_SWAP4(pcFrames->type);
|
|
|
|
// byte packed vertices
|
|
@@ -1173,6 +1176,7 @@ bool MDLImporter::ProcessFrames_3DGS_MDL7(const MDL::IntGroupInfo_MDL7 &groupInf
|
|
for (unsigned int iFrame = 0; iFrame < (unsigned int)groupInfo.pcGroup->numframes; ++iFrame) {
|
|
MDL::IntFrameInfo_MDL7 frame((BE_NCONST MDL::Frame_MDL7 *)szCurrent, iFrame);
|
|
|
|
+ VALIDATE_FILE_SIZE((const unsigned char *)(frame.pcFrame + 1));
|
|
AI_SWAP4(frame.pcFrame->vertices_count);
|
|
AI_SWAP4(frame.pcFrame->transmatrix_count);
|
|
|
|
--
|
|
2.52.0
|
|
|