diff options
| author | Andrey Kleshchev <andreykproductengine@lindenlab.com> | 2021-04-13 00:40:00 +0300 |
|---|---|---|
| committer | Andrey Kleshchev <andreykproductengine@lindenlab.com> | 2021-04-13 00:40:00 +0300 |
| commit | d0ac1505a7aebc98219fb5f60f6bfb73df6586ec (patch) | |
| tree | d41041895996f3dfedc60f7a4afe60a8e899130e /indra | |
| parent | 105416600e27a3d8a850617520ce86ca215222a1 (diff) | |
SL-15102 Crash at load_face_from_dom_triangles
Diffstat (limited to 'indra')
| -rw-r--r-- | indra/llprimitive/lldaeloader.cpp | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/indra/llprimitive/lldaeloader.cpp b/indra/llprimitive/lldaeloader.cpp index dfa29fb539..33e90555fa 100644 --- a/indra/llprimitive/lldaeloader.cpp +++ b/indra/llprimitive/lldaeloader.cpp @@ -198,6 +198,17 @@ LLModel::EModelStatus load_face_from_dom_triangles(std::vector<LLVolumeFace>& fa } LLVolumeFace::VertexMapData::PointMap point_map; + + if (idx_stride <= 0 + || (pos_source && pos_offset >= idx_stride) + || (tc_source && tc_offset >= idx_stride) + || (norm_source && norm_offset >= idx_stride)) + { + // Looks like these offsets should fit inside idx_stride + // Might be good idea to also check idx.getCount()%idx_stride != 0 + LL_WARNS() << "Invalid pos_offset " << pos_offset << ", tc_offset " << tc_offset << " or norm_offset " << norm_offset << LL_ENDL; + return LLModel::BAD_ELEMENT; + } for (U32 i = 0; i < idx.getCount(); i += idx_stride) { |