diff options
| author | Graham Linden <graham@lindenlab.com> | 2013-09-16 09:40:58 -0700 |
|---|---|---|
| committer | Graham Linden <graham@lindenlab.com> | 2013-09-16 09:40:58 -0700 |
| commit | d38bcb66217376745b0687f9002c8dd8267b5019 (patch) | |
| tree | 602dbd4e6a9c9a16ae02ec0810392474b599ab7d | |
| parent | bd0a8c7ee9f446a544fe27851d2d6b558545d772 (diff) | |
MAINT-2388 replace stomped fix to not crash when handed bogus model data
| -rwxr-xr-x | indra/llprimitive/llmodel.cpp | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/indra/llprimitive/llmodel.cpp b/indra/llprimitive/llmodel.cpp index e236f98fe6..4d93627116 100755 --- a/indra/llprimitive/llmodel.cpp +++ b/indra/llprimitive/llmodel.cpp @@ -238,6 +238,11 @@ LLModel::EModelStatus load_face_from_dom_triangles(std::vector<LLVolumeFace>& fa { // guard against model data specifiying out of range indices or norms // + if (((i + pos_offset) > index_count) + || ((idx[i+pos_offset]*3+2) > vertex_count)) + { + return LLModel::BAD_ELEMENT; + } if (((i + norm_offset) > index_count) || ((idx[i+norm_offset]*3+2) > norm_count)) { |