UnityMirror/spine-runtimes
1
0
Fork 0
mirror of https://github.com/EsotericSoftware/spine-runtimes.git synced 2026-02-28 04:31:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

[c] Fix weighted vertex buffer overflow using realloc growth

Browse Source
This commit is contained in:
Mario Zechner 2026-02-24 11:58:28 +01:00
parent 4572db6554
commit c9cd6428dc
1 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
spine-c/spine-c/src/spine/SkeletonBinary.c
View File

@ -1027,13 +1027,33 @@ static int _readVertices(_dataInput *input, float **vertices, int *verticesLengt
return *verticesLength;
}
float *v = MALLOC(float, (*verticesLength) * 3 * 3);
int *b = MALLOC(int, (*verticesLength) * 3);
int vertexCapacity = (*verticesLength) * 3 * 3;
int boneCapacity = (*verticesLength) * 3;
if (vertexCapacity < 8) vertexCapacity = 8;
if (boneCapacity < 8) boneCapacity = 8;
float *v = MALLOC(float, vertexCapacity);
int *b = MALLOC(int, boneCapacity);
int boneIdx = 0;
int vertexIdx = 0;
for (int i = 0; i < vertexCount; ++i) {
int boneCount = readVarint(input, 1);
int requiredBones = boneIdx + 1 + boneCount;
if (requiredBones > boneCapacity) {
while (boneCapacity < requiredBones) {
boneCapacity += boneCapacity >> 1;
}
b = REALLOC(b, int, boneCapacity);
}
b[boneIdx++] = boneCount;
int requiredVertices = vertexIdx + boneCount * 3;
if (requiredVertices > vertexCapacity) {
while (vertexCapacity < requiredVertices) {
vertexCapacity += vertexCapacity >> 1;
}
v = REALLOC(v, float, vertexCapacity);
}
for (int ii = 0; ii < boneCount; ++ii) {
b[boneIdx++] = readVarint(input, 1);
v[vertexIdx++] = readFloat(input) * scale;