From d38bcb66217376745b0687f9002c8dd8267b5019 Mon Sep 17 00:00:00 2001
From: Graham Linden <graham@lindenlab.com>
Date: Mon, 16 Sep 2013 09:40:58 -0700
Subject: MAINT-2388 replace stomped fix to not crash when handed bogus model
 data

---
 indra/llprimitive/llmodel.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/indra/llprimitive/llmodel.cpp b/indra/llprimitive/llmodel.cpp
index e236f98fe6..4d93627116 100755
--- a/indra/llprimitive/llmodel.cpp
+++ b/indra/llprimitive/llmodel.cpp
@@ -238,6 +238,11 @@ LLModel::EModelStatus load_face_from_dom_triangles(std::vector<LLVolumeFace>& fa
 		{
 			// guard against model data specifiying out of range indices or norms
 			//
+			if (((i + pos_offset) > index_count)
+				|| ((idx[i+pos_offset]*3+2) > vertex_count))
+			{
+				return LLModel::BAD_ELEMENT;
+			}
 			if (((i + norm_offset) > index_count)
 				|| ((idx[i+norm_offset]*3+2) > norm_count))
 			{
-- 
cgit v1.2.3