Merge pull request #512 from ctrlaltf2/oob-fix

Add bounds check to images loaded from bufferviews
syoyo · Jan 22, 2025 · a5e653e · a5e653e
2 parents 1831424 + d530cd4
commit a5e653e
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/tiny_gltf.h b/tiny_gltf.h
@@ -6453,6 +6453,15 @@ bool TinyGLTF::LoadFromString(Model *model, std::string *err, std::string *warn,
           return false;
         }
         const Buffer &buffer = model->buffers[size_t(bufferView.buffer)];
+        if (bufferView.byteOffset >= buffer.data.size()) {
+          if (err) {
+            std::stringstream ss;
+            ss << "image[" << idx << "] bufferView \"" << image.bufferView
+               << "\" indexed out of bounds of its buffer." << std::endl;
+            (*err) += ss.str();
+          }
+          return false;
+        }
 
         if (LoadImageData == nullptr) {
           if (err) {