]> git.lizzy.rs Git - irrlicht.git/commitdiff
CB3DMeshFileLoader: abort if offsets point outside of file
authorsfan5 <sfan5@live.de>
Sat, 15 Jan 2022 15:05:01 +0000 (16:05 +0100)
committersfan5 <sfan5@live.de>
Sat, 15 Jan 2022 15:06:30 +0000 (16:06 +0100)
fixes #70

source/Irrlicht/CB3DMeshFileLoader.cpp

index 41498eaa808bdf1b0d43db642d664de8ef5a02a5..05f9f0fd0f093998a87760b27e3b95ea45dcdcaa 100644 (file)
@@ -130,7 +130,8 @@ bool CB3DMeshFileLoader::load()
                else\r
                {\r
                        os::Printer::log("Unknown chunk found in mesh base - skipping");\r
-                       B3DFile->seek(B3dStack.getLast().startposition + B3dStack.getLast().length);\r
+                       if (!B3DFile->seek(B3dStack.getLast().startposition + B3dStack.getLast().length))\r
+                               return false;\r
                        B3dStack.erase(B3dStack.size()-1);\r
                }\r
        }\r
@@ -226,7 +227,8 @@ bool CB3DMeshFileLoader::readChunkNODE(CSkinnedMesh::SJoint *inJoint)
                else\r
                {\r
                        os::Printer::log("Unknown chunk found in node chunk - skipping");\r
-                       B3DFile->seek(B3dStack.getLast().startposition + B3dStack.getLast().length);\r
+                       if (!B3DFile->seek(B3dStack.getLast().startposition + B3dStack.getLast().length))\r
+                               return false;\r
                        B3dStack.erase(B3dStack.size()-1);\r
                }\r
        }\r
@@ -308,7 +310,8 @@ bool CB3DMeshFileLoader::readChunkMESH(CSkinnedMesh::SJoint *inJoint)
                else\r
                {\r
                        os::Printer::log("Unknown chunk found in mesh - skipping");\r
-                       B3DFile->seek(B3dStack.getLast().startposition + B3dStack.getLast().length);\r
+                       if (!B3DFile->seek(B3dStack.getLast().startposition + B3dStack.getLast().length))\r
+                               return false;\r
                        B3dStack.erase(B3dStack.size()-1);\r
                }\r
        }\r