mesh.Faces use wrong array length of buffer

[ZenDay]

In the function mesh.Faces, using the variable NumFaces as the buffer's length will cause the program to access unknown memory.
In fact, we should use 3 * NumFaces as the buffer's length.

As shown in the code below:

func (m *Mesh) Faces(buffer []uint32) []uint32 {
	n := m.NumFaces()*3
	if len(buffer) < int(n) {
		buffer = append(buffer, make([]uint32, int(n)-len(buffer))...)
	}
	C.dracoMeshGetIndices(m.ref, C.size_t(n*4), (*C.uint32_t)(unsafe.Pointer(&buffer[0])))
	return buffer[:n]
}

[qmuntal]

Thanks for reporting. Could you share a gltf model that triggers the bug?

[ZenDay]

Thanks for reporting. Could you share a gltf model that triggers the bug?

It will definitely produce the following error as long as you keep looping to decode any GLB file (about 100 times):

unexpected fault address 0xa4200000b4a
fatal error: fault
[signal SIGSEGV: segmentation violation code=0x1 addr=0xa4200000b4a pc=0x10300c773]