diff --git a/src/draco/io/gltf_decoder.cc b/src/draco/io/gltf_decoder.cc index 2ea71ec8a..dd2fd33fd 100644 --- a/src/draco/io/gltf_decoder.cc +++ b/src/draco/io/gltf_decoder.cc @@ -167,7 +167,14 @@ StatusOr> CopyDataAsUint32( tinygltf::GetComponentSizeInBytes(accessor.componentType); const int num_components = TinyGltfUtils::GetNumComponentsForType(accessor.type); - const int num_elements = accessor.count * num_components; + // Check for integer overflow in accessor.count * num_components. + const int64_t num_elements_64 = + static_cast(accessor.count) * num_components; + if (num_elements_64 > std::numeric_limits::max()) { + return Status(Status::DRACO_ERROR, + "CopyDataAsUint32: accessor count overflow."); + } + const int num_elements = static_cast(num_elements_64); std::vector output; output.resize(num_elements);