diff --git a/libraries/fbx/src/FBXSerializer_Node.cpp b/libraries/fbx/src/FBXSerializer_Node.cpp index f9ef84c6f2..717bc113dd 100644 --- a/libraries/fbx/src/FBXSerializer_Node.cpp +++ b/libraries/fbx/src/FBXSerializer_Node.cpp @@ -41,8 +41,14 @@ QVariant readBinaryArray(QDataStream& in, int& position) { quint32 compressedLength; in >> arrayLength; + if (arrayLength > std::numeric_limits::max() / sizeof(T)) { // Upcoming byte containers are limited to max signed int + throw QString("FBX file most likely corrupt: binary data exceeds data limits"); + } in >> encoding; in >> compressedLength; + if (compressedLength > std::numeric_limits::max() / sizeof(T)) { // Upcoming byte containers are limited to max signed int + throw QString("FBX file most likely corrupt: compressed binary data exceeds data limits"); + } position += sizeof(quint32) * 3; QVector values;