vtkGLTFImporter: Fix a invalid vector access CVE-2025-57108

Origin: upstream, https://gitlab.kitware.com/vtk/vtk/-/commit/ce07e9aef763d20d0f425386eef84226936ff3f4
Bug-Debian: https://bugs.debian.org/1119823

Gbp-Pq: Name cve_2025_57108.patch

diff --git a/IO/Import/vtkGLTFImporter.cxx b/IO/Import/vtkGLTFImporter.cxx
index fe8f9d21a1c793d9a2485e2df75fe2b670cb023d..73e83517c733d8847e86ae4d0173115a0d00fa11 100644 (file)
--- a/IO/Import/vtkGLTFImporter.cxx
+++ b/IO/Import/vtkGLTFImporter.cxx
@@ -668,6 +668,13 @@ void vtkGLTFImporter::ImportActors(vtkRenderer* renderer)
     // Import node's geometry
     if (node.Mesh >= 0)
     {
+      if (node.Mesh >= static_cast<int>(model->Meshes.size()))
+      {
+        vtkErrorMacro("Invalid node mesh index, aborting.");
+        this->SetUpdateStatus(vtkImporter::UpdateStatusEnum::FAILURE);
+        return;
+      }
+
       auto mesh = model->Meshes[node.Mesh];
       int primitiveId = 0;
       for (auto primitive : mesh.Primitives)