Added extra bounds checks (#288)

Resolves MSRC 113268 which is a low risk information disclosure bug.

Author: walbourn

DirectXMesh/DirectXMeshAdjacency.cpp

@@ -374,6 +374,11 @@ namespace
             const uint32_t v2 = pointRep[i1];
             const uint32_t v3 = pointRep[i2];
 
+            if (v1 >= nVerts
+                || v2 >= nVerts
+                || v3 >= nVerts)
+                return E_UNEXPECTED;
+
             // filter out degenerate triangles
             if (v1 == v2 || v1 == v3 || v2 == v3)
                 continue;

DirectXMesh/DirectXMeshGSAdjacency.cpp

@@ -64,6 +64,10 @@ namespace
                 {
                     indicesAdj[outputi] = indices[face * 3 + ((point + 2) % 3)];
                 }
+                else if (a >= nFaces)
+                {
+                    return E_UNEXPECTED;
+                }
                 else
                 {
                     uint32_t v1 = indices[face * 3 + point];
@@ -82,6 +86,10 @@ namespace
                         v1 = pointRep[v1];
                         v2 = pointRep[v2];
 
+                        if (((v1 != UNUSED32) && (v1 >= nVerts))
+                            || ((v2 != UNUSED32) && (v2 >= nVerts)))
+                            return E_UNEXPECTED;
+
                         uint32_t vOther = UNUSED32;
 
                         // find other vertex

DirectXMesh/DirectXMeshOptimizeTVC.cpp

@@ -112,6 +112,9 @@ namespace
 
                             if (neighbor != UNUSED32)
                             {
+                                if (neighbor >= nFaces)
+                                    return E_UNEXPECTED;
+
                                 if ((neighbor < faceOffset) || (neighbor >= faceMax)
                                     || (neighbor == adjacency[face * 3 + ((n + 1) % 3)])
                                     || (neighbor == adjacency[face * 3 + ((n + 2) % 3)]))

DirectXMesh/DirectXMeshRemap.cpp

@@ -66,7 +66,7 @@ namespace
                 }
             }
             else
-                return E_FAIL;
+                return E_UNEXPECTED;
         }
 
         return S_OK;
@@ -667,7 +667,7 @@ HRESULT DirectX::FinalizeVB(
         }
         else if (src >= newVerts)
         {
-            return E_FAIL;
+            return E_UNEXPECTED;
         }
         else if (src < nVerts)
         {
@@ -768,7 +768,7 @@ HRESULT DirectX::FinalizeVBAndPointReps(
             if (vertexRemap[j] != UNUSED32)
             {
                 if (vertexRemap[j] >= newVerts)
-                    return E_INVALIDARG;
+                    return E_UNEXPECTED;
 
                 vertexRemapInverse[vertexRemap[j]] = j;
             }
@@ -790,7 +790,11 @@ HRESULT DirectX::FinalizeVBAndPointReps(
 
     for (size_t i = 0; i < nDupVerts; ++i)
     {
-        pointRep[i + nVerts] = prin[dupVerts[i]];
+        uint32_t pr = dupVerts[i];
+        if (pr >= nDupVerts)
+            return E_UNEXPECTED;
+
+        pointRep[i + nVerts] = prin[pr];
     }
 
     for (size_t j = 0; j < newVerts; ++j)
@@ -801,10 +805,6 @@ HRESULT DirectX::FinalizeVBAndPointReps(
         {
             // remap entry is unused
         }
-        else if (src >= newVerts)
-        {
-            return E_FAIL;
-        }
         else if (src < nVerts)
         {
             memcpy(dptr, sptr + src * stride, stride);

DirectXMesh/DirectXMeshUtil.cpp

@@ -478,6 +478,9 @@ namespace
             if (indices[j] == index_t(-1))
                 continue;
 
+            if (indices[j] >= nVerts)
+                return;
+
             bool found = false;
 
             for (size_t ptr = 0; ptr < cacheSize; ++ptr)

DirectXMesh/DirectXMeshWeldVertices.cpp

@@ -120,6 +120,9 @@ namespace
             if (i == index_t(-1))
                 continue;
 
+            if (i >= nVerts)
+                return E_UNEXPECTED;
+
             indices[j] = index_t(vertexRemapInverse[i]);
         }