From 897e0ddebf1ecfa7c7f0870a81c9d2008d12f479 Mon Sep 17 00:00:00 2001 From: TristanInSec Date: Fri, 17 Apr 2026 11:54:15 -0400 Subject: [PATCH] Validate vertex indices in GetParallelogramEntries Check that vertex indices returned by the corner table are valid and within bounds of vertex_to_data_map before using them as array indices. --- ...h_prediction_scheme_parallelogram_shared.h | 24 ++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/src/draco/compression/attributes/prediction_schemes/mesh_prediction_scheme_parallelogram_shared.h b/src/draco/compression/attributes/prediction_schemes/mesh_prediction_scheme_parallelogram_shared.h index fd10fb524..3d38e2441 100644 --- a/src/draco/compression/attributes/prediction_schemes/mesh_prediction_scheme_parallelogram_shared.h +++ b/src/draco/compression/attributes/prediction_schemes/mesh_prediction_scheme_parallelogram_shared.h @@ -32,9 +32,27 @@ inline void GetParallelogramEntries( // One vertex of the input |table| correspond to exactly one attribute value // entry. The |table| can be either CornerTable for per-vertex attributes, // or MeshAttributeCornerTable for attributes with interior seams. - *opp_entry = vertex_to_data_map[table->Vertex(ci).value()]; - *next_entry = vertex_to_data_map[table->Vertex(table->Next(ci)).value()]; - *prev_entry = vertex_to_data_map[table->Vertex(table->Previous(ci)).value()]; + const VertexIndex vert_opp = table->Vertex(ci); + const VertexIndex vert_next = table->Vertex(table->Next(ci)); + const VertexIndex vert_prev = table->Vertex(table->Previous(ci)); + if (vert_opp == kInvalidVertexIndex || vert_next == kInvalidVertexIndex || + vert_prev == kInvalidVertexIndex) { + *opp_entry = -1; + *next_entry = -1; + *prev_entry = -1; + return; + } + if (vert_opp.value() >= vertex_to_data_map.size() || + vert_next.value() >= vertex_to_data_map.size() || + vert_prev.value() >= vertex_to_data_map.size()) { + *opp_entry = -1; + *next_entry = -1; + *prev_entry = -1; + return; + } + *opp_entry = vertex_to_data_map[vert_opp.value()]; + *next_entry = vertex_to_data_map[vert_next.value()]; + *prev_entry = vertex_to_data_map[vert_prev.value()]; } // Computes parallelogram prediction for a given corner and data entry id.