Skip to content

Commit 8df303e

Browse files
committed
#4399 Crash at load_face_from_dom_triangles
Since these offsets are used for idx[i+offset] where i starts from 0, they shouldn't be below 0 to not go out of bounds.
1 parent 4b69fe3 commit 8df303e

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

indra/llprimitive/lldaeloader.cpp

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -204,12 +204,15 @@ LLModel::EModelStatus load_face_from_dom_triangles(
204204

205205
if (idx_stride <= 0
206206
|| (pos_source && pos_offset >= idx_stride)
207+
|| (pos_source && pos_offset < 0)
207208
|| (tc_source && tc_offset >= idx_stride)
208-
|| (norm_source && norm_offset >= idx_stride))
209+
|| (tc_source && tc_offset < 0)
210+
|| (norm_source && norm_offset >= idx_stride)
211+
|| (norm_source && norm_offset < 0))
209212
{
210213
// Looks like these offsets should fit inside idx_stride
211214
// Might be good idea to also check idx.getCount()%idx_stride != 0
212-
LL_WARNS() << "Invalid pos_offset " << pos_offset << ", tc_offset " << tc_offset << " or norm_offset " << norm_offset << LL_ENDL;
215+
LL_WARNS() << "Invalid idx_stride " << idx_stride << ", pos_offset " << pos_offset << ", tc_offset " << tc_offset << " or norm_offset " << norm_offset << LL_ENDL;
213216
return LLModel::BAD_ELEMENT;
214217
}
215218

0 commit comments

Comments
 (0)