Skip to content

Commit

Permalink
spec: fix MATERIAL.map
Browse files Browse the repository at this point in the history
the 2nd mapper transmatrix was wrong, we need a texture here.
This caused a double-free if map.source == 2.
Only found via fuzzing GH #256 by @seviezhou.
  • Loading branch information
rurban committed Aug 1, 2020
1 parent fbadd6e commit 8582ca9
Showing 1 changed file with 9 additions and 9 deletions.
18 changes: 9 additions & 9 deletions src/dwg.spec
Original file line number Diff line number Diff line change
Expand Up @@ -7623,15 +7623,15 @@ DWG_SUBCLASS_DECL (MATERIAL, Texture_diffusemap);
}

#define MAT_MAP(map, dxf1, dxf2, dxf3, dxf4, dxf5, dxf6, dxf7) \
FIELD_BD (map.blendfactor, dxf1); \
MAT_MAPPER (map, dxf4, dxf5, dxf6, dxf7); \
FIELD_RC (map.source, dxf2); /* 0 scene, 1 file (def), 2 procedural */ \
if (FIELD_VALUE (map.source) == 1) \
{ \
FIELD_T (map.filename, dxf3); /* if NULL no map */ \
} \
else if (FIELD_VALUE (map.source) == 2) \
MAT_MAPPER (map, dxf4, dxf5, dxf6, dxf7)
FIELD_BD (map.blendfactor, dxf1); \
MAT_MAPPER (map, dxf4, dxf5, dxf6, dxf7); \
FIELD_RC (map.source, dxf2); /* 0 scene, 1 file (def), 2 procedural */ \
if (FIELD_VALUE (map.source) == 1) \
{ \
FIELD_T (map.filename, dxf3); /* if NULL no map */ \
} \
else if (FIELD_VALUE (map.source) == 2) \
MAT_TEXTURE (map, 0)

#define Texture_diffusemap_fields MAT_TEXTURE (diffusemap, 0)
DWG_SUBCLASS (MATERIAL, Texture_diffusemap);
Expand Down

0 comments on commit 8582ca9

Please sign in to comment.