kicad-developers team mailing list archive

[Mark Roszko <mark.roszko@xxxxxxxxx>]

The root defect is the vrml has ~15 coordIndex tags that exceeds 128
bytes total.
The parser being pretty bad uses a fixed 128 byte buffer to read tags into.
The parser in GetNextTag did not have bound checking and thus would
happily corrupt memory reading in that tag.

My patch prevented GetNextTag from overflowing.
There's still some funniness with he model as it won't load but I
suspect its because its using unsupported vrml definitions.