From 2ec972af54fe9c8c241e89387f3516ebd4b68c3b Mon Sep 17 00:00:00 2001
From: Monster Iestyn <iestynjealous@ntlworld.com>
Date: Thu, 3 Nov 2016 20:40:17 +0000
Subject: [PATCH] check numVertices, bail out and print error message if there
are too many
I added similar checks for the other num* but it seems some MD2s break the other limits without knowing anyway ...so I've commented these checks out for now, unless we have further discussion regarding them later on
---
src/hardware/hw_md2.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/src/hardware/hw_md2.c b/src/hardware/hw_md2.c
index 8e48ec1103..8e2b9a5b55 100644
--- a/src/hardware/hw_md2.c
+++ b/src/hardware/hw_md2.c
@@ -308,6 +308,23 @@ static md2_model_t *md2_readModel(const char *filename)
model->header.numSkins = 1;
+#define MD2LIMITCHECK(field, max, msgname) \
+ if (field >= max) \
+ { \
+ CONS_Alert(CONS_ERROR, "md2_readModel: %s has too many " msgname " (# found: %d, maximum: %d)\n", filename, field, max); \
+ md2_freeModel (model); \
+ return 0; \
+ }
+
+ // Uncomment if these are actually needed
+// MD2LIMITCHECK(model->header.numSkins, MD2_MAX_SKINS, "skins")
+// MD2LIMITCHECK(model->header.numTexCoords, MD2_MAX_TEXCOORDS, "texture coordinates")
+// MD2LIMITCHECK(model->header.numTriangles, MD2_MAX_TRIANGLES, "triangles")
+// MD2LIMITCHECK(model->header.numFrames, MD2_MAX_FRAMES, "frames")
+ MD2LIMITCHECK(model->header.numVertices, MD2_MAX_VERTICES, "vertices")
+
+#undef MD2LIMITCHECK
+
// read skins
fseek(file, model->header.offsetSkins, SEEK_SET);
if (model->header.numSkins > 0)
@@ -319,8 +336,6 @@ static md2_model_t *md2_readModel(const char *filename)
md2_freeModel (model);
return 0;
}
-
- ;
}
// read texture coordinates
@@ -334,8 +349,6 @@ static md2_model_t *md2_readModel(const char *filename)
md2_freeModel (model);
return 0;
}
-
-
}
// read triangles
--
GitLab