benkyd/tinyobjloader
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Limit # of tags when parsing SubD tag('t').

Browse Source
This commit is contained in:
Syoyo Fujita
2018-05-31 16:25:39 +09:00
parent 0c8db8ee23
commit 06f6139d1f
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
tiny_obj_loader.h
View File

@@ -1992,6 +1992,7 @@ bool LoadObj(attrib_t *attrib, std::vector<shape_t> *shapes,
} }
if (token[0] == 't' && IS_SPACE(token[1])) { if (token[0] == 't' && IS_SPACE(token[1])) {
const int max_tag_nums = 8192; // FIXME(syoyo): Parameterize.
tag_t tag; tag_t tag;
token += 2; token += 2;
@@ -2003,14 +2004,23 @@ bool LoadObj(attrib_t *attrib, std::vector<shape_t> *shapes,
if (ts.num_ints < 0) { if (ts.num_ints < 0) {
ts.num_ints = 0; ts.num_ints = 0;
} }
if (ts.num_ints > max_tag_nums) {
ts.num_ints = max_tag_nums;
}
if (ts.num_reals < 0) { if (ts.num_reals < 0) {
ts.num_reals = 0; ts.num_reals = 0;
} }
if (ts.num_reals > max_tag_nums) {
ts.num_reals = max_tag_nums;
}
if (ts.num_strings < 0) { if (ts.num_strings < 0) {
ts.num_strings = 0; ts.num_strings = 0;
} }
if (ts.num_strings > max_tag_nums) {
ts.num_strings = max_tag_nums;
}
tag.intValues.resize(static_cast<size_t>(ts.num_ints)); tag.intValues.resize(static_cast<size_t>(ts.num_ints));