From c3142fe2fa44b37abe5e8f25db04ce1c273afb45 Mon Sep 17 00:00:00 2001
From: Mathieu Westphal <mathieu.westphal@kitware.com>
Date: Tue, 13 Oct 2026 12:08:50 +0200
Subject: [PATCH] vtkGLTFDocumentLoader: Fix an invalid access for
 CVE-2025-57107

Origin: upstream, https://gitlab.kitware.com/vtk/vtk/-/commit/0aafd788bb920719f875f16ea1149712aa9099df
Bug-Debian: https://bugs.debian.org/1119822


Gbp-Pq: Name cve_2025_57107.patch
---
 IO/Geometry/vtkGLTFDocumentLoader.cxx | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/IO/Geometry/vtkGLTFDocumentLoader.cxx b/IO/Geometry/vtkGLTFDocumentLoader.cxx
index f1fe4ea61..aa4eaf23a 100644
--- a/IO/Geometry/vtkGLTFDocumentLoader.cxx
+++ b/IO/Geometry/vtkGLTFDocumentLoader.cxx
@@ -704,6 +704,13 @@ bool vtkGLTFDocumentLoader::ExtractPrimitiveAttributes(Primitive& primitive)
   // Load all attributes
   for (auto& attributePair : primitive.AttributeIndices)
   {
+    if (attributePair.second < 0 ||
+      attributePair.second >= static_cast<int>(this->InternalModel->Accessors.size()))
+    {
+      vtkErrorMacro("Invalid accessor index: " << attributePair.second);
+      return false;
+    }
+
     Accessor accessor = this->InternalModel->Accessors[attributePair.second];
     // Create array
     if (attributePair.first == "JOINTS_0")
-- 
2.39.5