From 06f6139d1fadd3f21338d204897205e4bba102b3 Mon Sep 17 00:00:00 2001
From: Syoyo Fujita <syoyo@lighttransport.com>
Date: Thu, 31 May 2018 16:25:39 +0900
Subject: [PATCH] Limit # of tags when parsing SubD tag('t').

---
 tiny_obj_loader.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tiny_obj_loader.h b/tiny_obj_loader.h
index f1e14eb..4f87a9b 100644
--- a/tiny_obj_loader.h
+++ b/tiny_obj_loader.h
@@ -1992,6 +1992,7 @@ bool LoadObj(attrib_t *attrib, std::vector<shape_t> *shapes,
     }
 
     if (token[0] == 't' && IS_SPACE(token[1])) {
+      const int max_tag_nums = 8192; // FIXME(syoyo): Parameterize.
       tag_t tag;
 
       token += 2;
@@ -2003,14 +2004,23 @@ bool LoadObj(attrib_t *attrib, std::vector<shape_t> *shapes,
       if (ts.num_ints < 0) {
         ts.num_ints = 0;
       }
+      if (ts.num_ints > max_tag_nums) {
+        ts.num_ints = max_tag_nums;
+      }
 
       if (ts.num_reals < 0) {
         ts.num_reals = 0;
       }
+      if (ts.num_reals > max_tag_nums) {
+        ts.num_reals = max_tag_nums;
+      }
 
       if (ts.num_strings < 0) {
         ts.num_strings = 0;
       }
+      if (ts.num_strings > max_tag_nums) {
+        ts.num_strings = max_tag_nums;
+      }
 
       tag.intValues.resize(static_cast<size_t>(ts.num_ints));