Merge pull request #462 from liaxim/sec

Buffer overflow fix
Samsung · Mar 11, 2016 · e5f1206 · e5f1206
2 parents 4b6ca90 + 4e8fc63
commit e5f1206
Showing 1 changed file with 14 additions and 2 deletions.
diff --git a/GVRf/Framework/jni/objects/vertex_bone_data.cpp b/GVRf/Framework/jni/objects/vertex_bone_data.cpp
@@ -49,9 +49,21 @@ int VertexBoneData::getFreeBoneSlot(int vertexId) {
     return boneData[vertexId].getFreeBoneSlot();
 }
 
+#define unlikely(x) __builtin_expect(!!(x), 0)
 void VertexBoneData::setVertexBoneWeight(int vertexId, int boneSlot, int boneId, float boneWeight) {
-    boneData[vertexId].ids[boneSlot] = boneId;
-    boneData[vertexId].weights[boneSlot] = boneWeight;
+    if (unlikely(BONES_PER_VERTEX <= boneSlot || 0 > boneSlot)) {
+        FAIL("index out of bounds; boneSlot: %d", boneSlot);
+    }
+    if (unlikely(MAX_BONES <= boneId || 0 > boneId)) {
+        FAIL("index out of bounds; boneId: %d", boneId);
+    }
+    if (unlikely(boneData.size() <= vertexId)) {
+        FAIL("index out of bounds; vertexId: %d", vertexId);
+    }
+
+    BoneData& boneDataElement = boneData[vertexId];
+    boneDataElement.ids[boneSlot] = boneId;
+    boneDataElement.weights[boneSlot] = boneWeight;
 }
 
 void VertexBoneData::normalizeWeights() {