SL-15183 Crash at LLModel::matchMaterialOrder

1 files changed, 8 insertions, 0 deletions

diff --git a/indra/llprimitive/llmodel.cpp b/indra/llprimitive/llmodel.cpp
index 702a1b5238..1b34068ece 100644
--- a/indra/llprimitive/llmodel.cpp
+++ b/indra/llprimitive/llmodel.cpp
@@ -1262,6 +1262,14 @@ bool LLModel::matchMaterialOrder(LLModel* ref, int& refFaceCnt, int& modelFaceCn
 		LL_INFOS("MESHSKININFO")<<"Material of model is not a subset of reference."<<LL_ENDL;
 		return false;
 	}
+
+    if (mMaterialList.size() > ref->mMaterialList.size())
+    {
+        LL_INFOS("MESHSKININFO") << "Material of model has more materials than a reference." << LL_ENDL;
+        // We passed isMaterialListSubset, so materials are a subset, but subset isn't supposed to be
+        // larger than original and if we keep going, reordering will cause a crash
+        return false;
+    }
 	
 	std::map<std::string, U32> index_map;