From 543b35ba635d9f4bd1dfd386b7ddd0e69fbb6f44 Mon Sep 17 00:00:00 2001 From: vro Date: Thu, 24 Oct 2013 12:00:10 +0400 Subject: [PATCH] 0023846: A crash on reading of a VRML file with wrong indices A check of indices. Test cases for issue CR23846 --- src/VrmlData/VrmlData_IndexedFaceSet.cxx | 22 ++++++++++++++++++---- tests/bugs/xde/bug23846 | 11 +++++++++++ 2 files changed, 29 insertions(+), 4 deletions(-) create mode 100755 tests/bugs/xde/bug23846 diff --git a/src/VrmlData/VrmlData_IndexedFaceSet.cxx b/src/VrmlData/VrmlData_IndexedFaceSet.cxx index 164775f5de..42ecd032a7 100755 --- a/src/VrmlData/VrmlData_IndexedFaceSet.cxx +++ b/src/VrmlData/VrmlData_IndexedFaceSet.cxx @@ -93,11 +93,18 @@ const Handle(TopoDS_TShape)& VrmlData_IndexedFaceSet::TShape () NCollection_DataMap mapNodeId; // Count non-degenerated triangles + const int nNodes = myCoords->Length(); for (i = 0; i < (int)myNbPolygons; i++) { const Standard_Integer * arrIndice; if (Polygon(i, arrIndice) == 3) { - if (arrIndice[0] < 0) - continue; + //Check indices for out of bound + if (arrIndice[0] < 0 || + arrIndice[0] >= nNodes || + arrIndice[1] >= nNodes || + arrIndice[2] >= nNodes) + { + continue; + } const gp_XYZ aVec[2] = { arrNodes[arrIndice[1]] - arrNodes[arrIndice[0]], arrNodes[arrIndice[2]] - arrNodes[arrIndice[0]] @@ -148,7 +155,10 @@ const Handle(TopoDS_TShape)& VrmlData_IndexedFaceSet::TShape () for (i = 0; i < (int)myNbPolygons; i++) { const Standard_Integer * arrIndice; if (Polygon (i, arrIndice) == 3) - if (arrIndice[0] >= 0) // check to avoid previously skipped faces + if (arrIndice[0] >= 0 && + arrIndice[0] < nNodes && + arrIndice[1] < nNodes && + arrIndice[2] < nNodes) // check to avoid previously skipped faces aTriangles(++nTri).Set (mapNodeId(arrIndice[0]), mapNodeId(arrIndice[1]), mapNodeId(arrIndice[2])); @@ -179,7 +189,11 @@ const Handle(TopoDS_TShape)& VrmlData_IndexedFaceSet::TShape () for (i = 0; i < (int)myNbPolygons; i++) { const Standard_Integer * arrNodes; - if (Polygon(i, arrNodes) == 3 && arrNodes[0] >= 0) // check to avoid previously skipped faces + if (Polygon(i, arrNodes) == 3 && + arrNodes[0] >= 0 && + arrNodes[0] < nNodes && + arrNodes[1] < nNodes && + arrNodes[2] < nNodes) // check to avoid previously skipped faces { const Standard_Integer * arrIndice; if (IndiceNormals(i, arrIndice) == 3) { diff --git a/tests/bugs/xde/bug23846 b/tests/bugs/xde/bug23846 new file mode 100755 index 0000000000..d376d23cde --- /dev/null +++ b/tests/bugs/xde/bug23846 @@ -0,0 +1,11 @@ +puts "================" +puts "OCC23846" +puts "================" +puts "" +###################################################################################### +# A crash on reading of a VRML file with wrong indices +###################################################################################### + +loadvrml result [locate_data_file T00000112_0000.wrl] + +set 3dviewer 1 -- 2.39.5