From: Mathieu Westphal <mathieu.westphal@kitware.com>
Date: Tue, 13 Oct 2026 10:08:50 +0000 (+0200)
Subject: vtkGLTFImporter: Fix a invalid vector access CVE-2025-57108
X-Git-Tag: archive/raspbian/9.6.2+ds-3+rpi1^2~7
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=1c4f766de65db28616a4e3ca4316959c46d50a20;p=vtk9.git

vtkGLTFImporter: Fix a invalid vector access CVE-2025-57108

Origin: upstream, https://gitlab.kitware.com/vtk/vtk/-/commit/ce07e9aef763d20d0f425386eef84226936ff3f4
Bug-Debian: https://bugs.debian.org/1119823


Gbp-Pq: Name cve_2025_57108.patch
---

diff --git a/IO/Import/vtkGLTFImporter.cxx b/IO/Import/vtkGLTFImporter.cxx
index fe8f9d21a..73e83517c 100644
--- a/IO/Import/vtkGLTFImporter.cxx
+++ b/IO/Import/vtkGLTFImporter.cxx
@@ -668,6 +668,13 @@ void vtkGLTFImporter::ImportActors(vtkRenderer* renderer)
     // Import node's geometry
     if (node.Mesh >= 0)
     {
+      if (node.Mesh >= static_cast<int>(model->Meshes.size()))
+      {
+        vtkErrorMacro("Invalid node mesh index, aborting.");
+        this->SetUpdateStatus(vtkImporter::UpdateStatusEnum::FAILURE);
+        return;
+      }
+
       auto mesh = model->Meshes[node.Mesh];
       int primitiveId = 0;
       for (auto primitive : mesh.Primitives)