bartvdbraak/blender
1
0
Fork 4
Code Issues 4 Pull Requests 1 Actions 1 Packages Projects Releases Wiki Activity

Fix integer overflows in meshcache modifier.

Browse Source 
Differential Revision: https://developer.blender.org/D2688
This commit is contained in:
lazydodo 2017-05-26 06:26:21 -06:00
parent bf5e717ef5
commit bddd9d809d
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
source/blender/modifiers/intern/MOD_meshcache_mdd.c
View File

@ -35,6 +35,9 @@
#ifdef __LITTLE_ENDIAN__
# include "BLI_endian_switch.h"
#endif
#ifdef WIN32
# include "BLI_winstuff.h"
#endif
#include "MOD_meshcache_util.h" /* own include */
@ -157,7 +160,7 @@ bool MOD_meshcache_read_mdd_index(FILE *fp,
return false;
}
if (fseek(fp, index * mdd_head.verts_tot * sizeof(float) * 3, SEEK_CUR) != 0) {
if (fseek(fp, sizeof(float) * 3 * index * mdd_head.verts_tot, SEEK_CUR) != 0) {
*err_str = "Failed to seek frame";
return false;
}

6
source/blender/modifiers/intern/MOD_meshcache_pc2.c
View File

@ -35,6 +35,10 @@
# include "BLI_endian_switch.h"
#endif
#ifdef WIN32
# include "BLI_winstuff.h"
#endif
#include "MOD_meshcache_util.h" /* own include */
#include "DNA_modifier_types.h"
@ -142,7 +146,7 @@ bool MOD_meshcache_read_pc2_index(FILE *fp,
return false;
}
if (fseek(fp, index * pc2_head.verts_tot * sizeof(float) * 3, SEEK_CUR) != 0) {
if (fseek(fp, sizeof(float) * 3 * index * pc2_head.verts_tot , SEEK_CUR) != 0) {
*err_str = "Failed to seek frame";
return false;
}