luanti-org/luanti
1
0
Fork 0
mirror of https://github.com/luanti-org/luanti.git synced 2026-10-12 02:18:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

glTF loader: Validate sampler input-output sizes

Browse Source 
Prevents otherwise possible OOB reads later on
This commit is contained in:
Lars Mueller
2026-08-12 23:29:21 +02:00
committed by sfan5
parent e60c896ab9
commit e61ec0627a
1 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/tiniergltf/tiniergltf.hpp
+14 -3
View File
@@ -1404,10 +1404,21 @@ struct GlTF {
checkForall(animations, [&](const Animation &animation) {
for (const auto &sampler : animation.samplers) {
checkIndex(accessors, sampler.input);
const auto &accessor = accessors->at(sampler.input);
check(accessor.type == Accessor::Type::SCALAR);
check(accessor.componentType == Accessor::ComponentType::FLOAT);
const auto &in_acc = accessors->at(sampler.input);
check(in_acc.type == Accessor::Type::SCALAR);
check(in_acc.componentType == Accessor::ComponentType::FLOAT);
checkIndex(accessors, sampler.output);
const auto &out_acc = accessors->at(sampler.output);
switch (sampler.interpolation) {
case AnimationSampler::Interpolation::STEP:
case AnimationSampler::Interpolation::LINEAR:
check(in_acc.count == out_acc.count);
break;
case AnimationSampler::Interpolation::CUBICSPLINE:
check(in_acc.count >= 2);
check(out_acc.count == in_acc.count * 3);
break;
}
}
for (const auto &channel : animation.channels) {
checkIndex(nodes, channel.target.node);