From: Mathieu Westphal <mathieu.westphal@kitware.com>
Date: Tue, 13 Oct 2026 10:08:50 +0000 (+0200)
Subject: vtkGLTFImporter: Fix invalid access for CVE-2025-57109
X-Git-Tag: archive/raspbian/9.6.2+ds-3+rpi1^2~6
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=51f34d5b1d9420aa771e07cc66cfd282b287a4f0;p=vtk9.git

vtkGLTFImporter: Fix invalid access for CVE-2025-57109

Origin: upstream, https://gitlab.kitware.com/vtk/vtk/-/commit/79375066e52db70e61dbaef7d941d642daf2dc09
Bug-Debian: https://bugs.debian.org/1119824


Gbp-Pq: Name cve_2025_57109.patch
---

diff --git a/IO/Import/vtkGLTFImporter.cxx b/IO/Import/vtkGLTFImporter.cxx
index 73e83517c..9c99df74f 100644
--- a/IO/Import/vtkGLTFImporter.cxx
+++ b/IO/Import/vtkGLTFImporter.cxx
@@ -649,6 +649,13 @@ void vtkGLTFImporter::ImportActors(vtkRenderer* renderer)
     // Get current node
     const int nodeId = nodeIdStack.top();
     nodeIdStack.pop();
+    if (nodeId < 0 || nodeId >= static_cast<int>(model->Nodes.size()))
+    {
+      vtkErrorMacro("Invalid node index: " << nodeId << " , aborting.");
+      this->SetUpdateStatus(vtkImporter::UpdateStatusEnum::FAILURE);
+      return;
+    }
+
     const auto& node = model->Nodes[nodeId];
 
     // Add this node into the scene hierarchy
@@ -670,7 +677,7 @@ void vtkGLTFImporter::ImportActors(vtkRenderer* renderer)
     {
       if (node.Mesh >= static_cast<int>(model->Meshes.size()))
       {
-        vtkErrorMacro("Invalid node mesh index, aborting.");
+        vtkErrorMacro("Invalid node mesh index: " << node.Mesh << " , aborting.");
         this->SetUpdateStatus(vtkImporter::UpdateStatusEnum::FAILURE);
         return;
       }
@@ -835,6 +842,14 @@ void vtkGLTFImporter::ImportCameras(vtkRenderer* renderer)
     // Get current node
     int nodeId = nodeIdStack.top();
     nodeIdStack.pop();
+
+    if (nodeId < 0 || nodeId >= static_cast<int>(model->Nodes.size()))
+    {
+      vtkErrorMacro("Invalid nodeId: " << nodeId << ", aborting.");
+      this->SetUpdateStatus(vtkImporter::UpdateStatusEnum::FAILURE);
+      return;
+    }
+
     const vtkGLTFDocumentLoader::Node& node = model->Nodes[nodeId];
 
     // Import node's camera