SF.net SVN: openvrml:[3497] trunk

[<br...@us...>]

Revision: 3497
          http://openvrml.svn.sourceforge.net/openvrml/?rev=3497&view=rev
Author:   braden
Date:     2008-07-26 08:29:32 +0000 (Sat, 26 Jul 2008)

Log Message:
-----------
Fixed some potential crashes when processing coordinate, color, and normal indices.

Modified Paths:
--------------
    trunk/ChangeLog
    trunk/src/libopenvrml-gl/openvrml/gl/viewer.cpp

Modified: trunk/ChangeLog
===================================================================
--- trunk/ChangeLog	2008-07-23 17:16:29 UTC (rev 3496)
+++ trunk/ChangeLog	2008-07-26 08:29:32 UTC (rev 3497)
@@ -1,3 +1,24 @@
+2008-07-26 Braden McDaniel  <br...@en...>
+
+	Fixed some potential crashes when processing coordinate, color,
+	and normal indices.
+
+	* src/libopenvrml-gl/openvrml/gl/viewer.cpp
+	(insertShellTess(GLUtesselator &, const std::vector<vertex_data>&,
+	const std::vector<openvrml::int32> &, bool, const
+	std::vector<openvrml::color> &, const
+	std::vector<openvrml::int32>&, bool, const
+	std::vector<openvrml::vec3f> &, const
+	std::vector<openvrml::int32>&)): Advance past invalid coordinate
+	indices.
+	(openvrml::gl::viewer::do_insert_shell(unsigned int, const
+	std::vector<vec3f> &, const std::vector<int32> &, const
+	std::vector<color> &, const std::vector<int32> &, const
+	std::vector<vec3f> & const std::vector<int32> &, const
+	std::vector<vec2f> &, const std::vector<int32> &)): Advance past
+	-1 entries and invalid coordinate indices in the colorIndex and
+	normalIndex fields.
+
 2008-07-23 Braden McDaniel  <br...@en...>
 
 	Use GtkBuilder in openvrml-player instead of libglade.  Note that

Modified: trunk/src/libopenvrml-gl/openvrml/gl/viewer.cpp
===================================================================
--- trunk/src/libopenvrml-gl/openvrml/gl/viewer.cpp	2008-07-23 17:16:29 UTC (rev 3496)
+++ trunk/src/libopenvrml-gl/openvrml/gl/viewer.cpp	2008-07-26 08:29:32 UTC (rev 3497)
@@ -2939,7 +2939,14 @@
         for (vector<openvrml::int32>::size_type i = 0;
              i < coord_index.size();
              ++i) {
-            if (coord_index[i] != -1) {
+            using openvrml::int32;
+            if (!(coord_index[i] < int32(vertices.size()))) {
+                //
+                // We've encountered an invalid coordinate index.  Advance to
+                // the next polygon.
+                //
+                while (coord_index[i + 1] != -1) { ++i; }
+            } else if (coord_index[i] != -1) {
                 gluTessVertex(&tessobj,
                               const_cast<GLdouble *>(
                                   vertices[coord_index[i]].coord),
@@ -3060,11 +3067,13 @@
                      ++i) {
                     vertices[i].color = &color[i];
                 }
-            } else {
+            } else if (color_index.size() == coord_index.size()) {
                 for (vector<int32>::size_type i = 0;
                      i < color_index.size();
                      ++i) {
-                    vertices[i].color = &color[color_index[i]];
+                    if (color_index[i] < 0) { continue; }
+                    if (!(coord_index[i] < coord.size())) { continue; }
+                    vertices[coord_index[i]].color = &color[color_index[i]];
                 }
             }
         }
@@ -3075,11 +3084,13 @@
                      ++i) {
                     vertices[i].normal = &normal[i];
                 }
-            } else {
+            } else if (normal_index.size() == coord_index.size()) {
                 for (vector<int32>::size_type i = 0;
                      i < normal_index.size();
                      ++i) {
-                    vertices[i].normal = &normal[normal_index[i]];
+                    if (normal_index[i] < 0) { continue; }
+                    if (!(coord_index[i] < coord.size())) { continue; }
+                    vertices[coord_index[i]].normal = &normal[normal_index[i]];
                 }
             }
         }
@@ -3094,6 +3105,7 @@
             for (vector<int32>::size_type i = 0;
                  i < tex_coord_index.size();
                  ++i) {
+                if (tex_coord_index[i] < 0) { continue; }
                 vertices[tex_coord_index[i]].tex_coord =
                     &tex_coord[tex_coord_index[i]];
             }


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.