Add bounds check to images loaded from bufferviews

syoyo · Jan 21, 2025 · d530cd4 · d530cd4
1 parent 1831424
commit d530cd4
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/tiny_gltf.h b/tiny_gltf.h
@@ -6453,6 +6453,15 @@ bool TinyGLTF::LoadFromString(Model *model, std::string *err, std::string *warn,
           return false;
         }
         const Buffer &buffer = model->buffers[size_t(bufferView.buffer)];
+        if (bufferView.byteOffset >= buffer.data.size()) {
+          if (err) {
+            std::stringstream ss;
+            ss << "image[" << idx << "] bufferView \"" << image.bufferView
+               << "\" indexed out of bounds of its buffer." << std::endl;
+            (*err) += ss.str();
+          }
+          return false;
+        }
 
         if (LoadImageData == nullptr) {
           if (err) {