vtkGLTFDocumentLoader: Fix an invalid access for CVE-2025-57107

Origin: upstream, https://gitlab.kitware.com/vtk/vtk/-/commit/0aafd788bb920719f875f16ea1149712aa9099df
Bug-Debian: https://bugs.debian.org/1119822

Gbp-Pq: Name cve_2025_57107.patch

diff --git a/IO/Geometry/vtkGLTFDocumentLoader.cxx b/IO/Geometry/vtkGLTFDocumentLoader.cxx
index f1fe4ea615d1af67a566050faf1fdc79268eeced..aa4eaf23a870cdbe8dabc6b24f246e719a527ad1 100644 (file)
--- a/IO/Geometry/vtkGLTFDocumentLoader.cxx
+++ b/IO/Geometry/vtkGLTFDocumentLoader.cxx
@@ -704,6 +704,13 @@ bool vtkGLTFDocumentLoader::ExtractPrimitiveAttributes(Primitive& primitive)
   // Load all attributes
   for (auto& attributePair : primitive.AttributeIndices)
   {
+    if (attributePair.second < 0 ||
+      attributePair.second >= static_cast<int>(this->InternalModel->Accessors.size()))
+    {
+      vtkErrorMacro("Invalid accessor index: " << attributePair.second);
+      return false;
+    }
+
     Accessor accessor = this->InternalModel->Accessors[attributePair.second];
     // Create array
     if (attributePair.first == "JOINTS_0")