+ add security checks to SoBrep nodes

src/Mod/Part/Gui/SoBrepEdgeSet.cpp

@@ -50,6 +50,7 @@
 # include <Inventor/elements/SoGLCacheContextElement.h>
 # include <Inventor/elements/SoLineWidthElement.h>
 # include <Inventor/elements/SoPointSizeElement.h>
+# include <Inventor/errors/SoDebugError.h>
 # include <Inventor/errors/SoReadError.h>
 # include <Inventor/details/SoFaceDetail.h>
 # include <Inventor/details/SoLineDetail.h>
@@ -153,8 +154,13 @@ void SoBrepEdgeSet::renderHighlight(SoGLRenderAction *action)
     int num = (int)this->hl.size();
     if (num > 0) {
         const int32_t* id = &(this->hl[0]);
+        if (!validIndexes(coords, this->hl)) {
+            SoDebugError::postWarning("SoBrepEdgeSet::renderHighlight", "highlightIndex out of range");
+        }
+        else {
             renderShape(static_cast<const SoGLCoordinateElement*>(coords), id, num);
         }
+    }
     state->pop();
 }
 
@@ -192,12 +198,26 @@ void SoBrepEdgeSet::renderSelection(SoGLRenderAction *action)
     if (num > 0) {
         cindices = &(this->sl[0]);
         numcindices = (int)this->sl.size();
-
+        if (!validIndexes(coords, this->sl)) {
+            SoDebugError::postWarning("SoBrepEdgeSet::renderSelection", "selectionIndex out of range");
+        }
+        else {
             renderShape(static_cast<const SoGLCoordinateElement*>(coords), cindices, numcindices);
         }
+    }
     state->pop();
 }
 
+bool SoBrepEdgeSet::validIndexes(const SoCoordinateElement* coords, const std::vector<int32_t>& pts) const
+{
+    for (std::vector<int32_t>::const_iterator it = pts.begin(); it != pts.end(); ++it) {
+        if (*it >= coords->getNum()) {
+            return false;
+        }
+    }
+    return true;
+}
+
 static void createIndexArray(const int32_t* segm, int numsegm,
                              const int32_t* cindices, int numcindices,
                              std::vector<int32_t>& out)
@@ -292,9 +312,11 @@ void SoBrepEdgeSet::doAction(SoAction* action)
             switch (selaction->getType()) {
             case Gui::SoSelectionElementAction::Append:
                 {
+                    if (this->selectionIndex.find(index) < 0) {
                         int start = this->selectionIndex.getNum();
                         this->selectionIndex.set1Value(start, index);
                     }
+                }
                 break;
             case Gui::SoSelectionElementAction::Remove:
                 {

src/Mod/Part/Gui/SoBrepEdgeSet.h

@@ -33,6 +33,7 @@
 #include <Inventor/elements/SoReplacedElement.h>
 #include <vector>
 
+class SoCoordinateElement;
 class SoGLCoordinateElement;
 class SoTextureCoordinateBundle;
 
@@ -66,6 +67,7 @@ private:
                      int num_vertexindices);
     void renderHighlight(SoGLRenderAction *action);
     void renderSelection(SoGLRenderAction *action);
+    bool validIndexes(const SoCoordinateElement*, const std::vector<int32_t>&) const;
 
 private:
     std::vector<int32_t> hl, sl;

src/Mod/Part/Gui/SoBrepFaceSet.cpp

@@ -51,6 +51,7 @@
 # include <Inventor/elements/SoGLCacheContextElement.h>
 # include <Inventor/elements/SoLineWidthElement.h>
 # include <Inventor/elements/SoPointSizeElement.h>
+# include <Inventor/errors/SoDebugError.h>
 # include <Inventor/errors/SoReadError.h>
 # include <Inventor/details/SoFaceDetail.h>
 # include <Inventor/details/SoLineDetail.h>
@@ -134,9 +135,11 @@ void SoBrepFaceSet::doAction(SoAction* action)
             switch (selaction->getType()) {
             case Gui::SoSelectionElementAction::Append:
                 {
+                    if (this->selectionIndex.find(index) < 0) {
                         int start = this->selectionIndex.getNum();
                         this->selectionIndex.set1Value(start, index);
                     }
+                }
                 break;
             case Gui::SoSelectionElementAction::Remove:
                 {
@@ -704,7 +707,10 @@ void SoBrepFaceSet::renderHighlight(SoGLRenderAction *action)
     mb.sendFirst(); // make sure we have the correct material
 
     int32_t id = this->highlightIndex.getValue();
-
+    if (id >= this->partIndex.getNum()) {
+        SoDebugError::postWarning("SoBrepFaceSet::renderHighlight", "highlightIndex out of range");
+    }
+    else {
         // just in case someone forgot
         if (!mindices) mindices = cindices;
         if (!nindices) nindices = cindices;
@@ -731,6 +737,7 @@ void SoBrepFaceSet::renderHighlight(SoGLRenderAction *action)
 
         renderShape(static_cast<const SoGLCoordinateElement*>(coords), &(cindices[start]), length,
             &(pindices[id]), 1, normals, nindices, &mb, mindices, &tb, tindices, nbind, mbind, doTextures?1:0);
+    }
     state->pop();
 }
 
@@ -787,6 +794,10 @@ void SoBrepFaceSet::renderSelection(SoGLRenderAction *action)
 
     for (int i=0; i<numSelected; i++) {
         int id = selected[i];
+        if (id >= this->partIndex.getNum()) {
+            SoDebugError::postWarning("SoBrepFaceSet::renderSelection", "selectionIndex out of range");
+            break;
+        }
 
         // coords
         int length = (int)pindices[id]*4;

src/Mod/Part/Gui/SoBrepPointSet.cpp

@@ -50,6 +50,7 @@
 # include <Inventor/elements/SoGLCacheContextElement.h>
 # include <Inventor/elements/SoLineWidthElement.h>
 # include <Inventor/elements/SoPointSizeElement.h>
+# include <Inventor/errors/SoDebugError.h>
 # include <Inventor/errors/SoReadError.h>
 # include <Inventor/details/SoFaceDetail.h>
 # include <Inventor/details/SoLineDetail.h>
@@ -143,8 +144,12 @@ void SoBrepPointSet::renderHighlight(SoGLRenderAction *action)
     mb.sendFirst(); // make sure we have the correct material
 
     int32_t id = this->highlightIndex.getValue();
-
+    if (id < this->startIndex.getValue() || id >= coords->getNum()) {
+        SoDebugError::postWarning("SoBrepPointSet::renderHighlight", "highlightIndex out of range");
+    }
+    else {
         renderShape(static_cast<const SoGLCoordinateElement*>(coords), &id, 1);
+    }
     state->pop();
 }
 
@@ -173,10 +178,26 @@ void SoBrepPointSet::renderSelection(SoGLRenderAction *action)
     cindices = this->selectionIndex.getValues(0);
     numcindices = this->selectionIndex.getNum();
 
+    if (!validIndexes(coords, this->startIndex.getValue(), cindices, numcindices)) {
+        SoDebugError::postWarning("SoBrepPointSet::renderSelection", "selectionIndex out of range");
+    }
+    else {
         renderShape(static_cast<const SoGLCoordinateElement*>(coords), cindices, numcindices);
+    }
     state->pop();
 }
 
+bool SoBrepPointSet::validIndexes(const SoCoordinateElement* coords, int32_t startIndex, const int32_t * cindices, int numcindices) const
+{
+    for (int i=0; i<numcindices; i++) {
+        int32_t id = cindices[i];
+        if (id < startIndex || id >= coords->getNum()) {
+            return false;
+        }
+    }
+    return true;
+}
+
 void SoBrepPointSet::doAction(SoAction* action)
 {
     if (action->getTypeId() == Gui::SoHighlightElementAction::getClassTypeId()) {
@@ -226,9 +247,11 @@ void SoBrepPointSet::doAction(SoAction* action)
             switch (selaction->getType()) {
             case Gui::SoSelectionElementAction::Append:
                 {
+                    if (this->selectionIndex.find(index) < 0) {
                         int start = this->selectionIndex.getNum();
                         this->selectionIndex.set1Value(start, index);
                     }
+                }
                 break;
             case Gui::SoSelectionElementAction::Remove:
                 {

src/Mod/Part/Gui/SoBrepPointSet.h

@@ -33,6 +33,7 @@
 #include <Inventor/elements/SoReplacedElement.h>
 #include <vector>
 
+class SoCoordinateElement;
 class SoGLCoordinateElement;
 class SoTextureCoordinateBundle;
 
@@ -62,6 +63,7 @@ private:
                      int num_vertexindices);
     void renderHighlight(SoGLRenderAction *action);
     void renderSelection(SoGLRenderAction *action);
+    bool validIndexes(const SoCoordinateElement*, int32_t, const int32_t *, int) const;
 
 private:
     SbColor selectionColor;