vtkGLTFImporter: Fix invalid access for CVE-2025-57109

Origin: upstream, https://gitlab.kitware.com/vtk/vtk/-/commit/79375066e52db70e61dbaef7d941d642daf2dc09
Bug-Debian: https://bugs.debian.org/1119824

Gbp-Pq: Name cve_2025_57109.patch

diff --git a/IO/Import/vtkGLTFImporter.cxx b/IO/Import/vtkGLTFImporter.cxx
index 73e83517c733d8847e86ae4d0173115a0d00fa11..9c99df74fa576cc6cfa6715af696fc900c5a0e05 100644 (file)
--- a/IO/Import/vtkGLTFImporter.cxx
+++ b/IO/Import/vtkGLTFImporter.cxx
@@ -649,6 +649,13 @@ void vtkGLTFImporter::ImportActors(vtkRenderer* renderer)
     // Get current node
     const int nodeId = nodeIdStack.top();
     nodeIdStack.pop();
+    if (nodeId < 0 || nodeId >= static_cast<int>(model->Nodes.size()))
+    {
+      vtkErrorMacro("Invalid node index: " << nodeId << " , aborting.");
+      this->SetUpdateStatus(vtkImporter::UpdateStatusEnum::FAILURE);
+      return;
+    }
+
     const auto& node = model->Nodes[nodeId];
 
     // Add this node into the scene hierarchy
@@ -670,7 +677,7 @@ void vtkGLTFImporter::ImportActors(vtkRenderer* renderer)
     {
       if (node.Mesh >= static_cast<int>(model->Meshes.size()))
       {
-        vtkErrorMacro("Invalid node mesh index, aborting.");
+        vtkErrorMacro("Invalid node mesh index: " << node.Mesh << " , aborting.");
         this->SetUpdateStatus(vtkImporter::UpdateStatusEnum::FAILURE);
         return;
       }
@@ -835,6 +842,14 @@ void vtkGLTFImporter::ImportCameras(vtkRenderer* renderer)
     // Get current node
     int nodeId = nodeIdStack.top();
     nodeIdStack.pop();
+
+    if (nodeId < 0 || nodeId >= static_cast<int>(model->Nodes.size()))
+    {
+      vtkErrorMacro("Invalid nodeId: " << nodeId << ", aborting.");
+      this->SetUpdateStatus(vtkImporter::UpdateStatusEnum::FAILURE);
+      return;
+    }
+
     const vtkGLTFDocumentLoader::Node& node = model->Nodes[nodeId];
 
     // Import node's camera