FGFS-4.1/OpenSceneGraph
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Added check to avoid accessing pointer past the end of the string.

Browse Source
This commit is contained in:
Robert Osfield
2012-03-30 10:10:27 +00:00
parent c0bd5cda99
commit 6a40df7b7d
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/osgPlugins/OpenFlight/PaletteRecords.cpp
View File

@@ -66,11 +66,14 @@ protected:
uint32 paletteSize = in.readUInt32();
// Entries in vertex pool found by offset from start of this record.
const int RECORD_HEADER_SIZE = 4;
const int OFFSET = RECORD_HEADER_SIZE+sizeof(paletteSize);
const uint32 RECORD_HEADER_SIZE = 4;
const uint32 OFFSET = RECORD_HEADER_SIZE+sizeof(paletteSize);
std::string buffer(paletteSize,'\0');
in.read(&buffer[OFFSET], paletteSize-OFFSET);
if (OFFSET < paletteSize)
{
in.read(&buffer[OFFSET], paletteSize-OFFSET);
}
// Keep a copy of the vertex pool in memory for later reference.
document.setVertexPool(new VertexPool(buffer));