diff --git a/CVE-2025-11277.patch b/CVE-2025-11277.patch new file mode 100644 index 0000000000000000000000000000000000000000..2a679fc48ba0b5def9900970d666ef17046e9850 --- /dev/null +++ b/CVE-2025-11277.patch @@ -0,0 +1,38 @@ +From eeae4d2b61c545fdfd3784bb9358a09cd9c4c606 Mon Sep 17 00:00:00 2001 +From: root +Date: Thu, 20 Nov 2025 08:57:03 +0800 +Subject: [PATCH] Fix CVE-2025-11277 + +--- + code/AssetLib/Q3D/Q3DLoader.cpp | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/code/AssetLib/Q3D/Q3DLoader.cpp b/code/AssetLib/Q3D/Q3DLoader.cpp +index c773bbf..36e7924 100644 +--- a/code/AssetLib/Q3D/Q3DLoader.cpp ++++ b/code/AssetLib/Q3D/Q3DLoader.cpp +@@ -55,6 +55,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + #include + #include + ++#include ++ + using namespace Assimp; + + static const aiImporterDesc desc = { +@@ -302,6 +304,12 @@ void Q3DImporter::InternReadFile(const std::string &pFile, + throw DeadlyImportError("Quick3D: Invalid texture. Width or height is zero"); + } + ++ const unsigned int uint_max = std::numeric_limits::max(); ++ if (tex->mWidth > (uint_max / tex->mHeight)) { ++ throw DeadlyImportError("Quick3D: Texture dimensions are too large, resulting in overflow."); ++ } ++ ++ + unsigned int mul = tex->mWidth * tex->mHeight; + aiTexel *begin = tex->pcData = new aiTexel[mul]; + aiTexel *const end = &begin[mul - 1] + 1; +-- +2.33.0 +