security: add bounds checks to decoder prediction schemes and point count

src/draco/compression/attributes/prediction_schemes/mesh_prediction_scheme_constrained_multi_parallelogram_decoder.h

@@ -82,7 +82,7 @@ template <typename DataTypeT, class TransformT, class MeshDataT>
 bool MeshPredictionSchemeConstrainedMultiParallelogramDecoder<
     DataTypeT, TransformT, MeshDataT>::
     ComputeOriginalValues(const CorrType *in_corr, DataTypeT *out_data,
-                          int /* size */, int num_components,
+                          int size, int num_components,
                           const PointIndex * /* entry_to_point_id_map */) {
   this->transform().Init(num_components);
 
@@ -107,6 +107,9 @@ bool MeshPredictionSchemeConstrainedMultiParallelogramDecoder<
 
   const int corner_map_size =
       static_cast<int>(this->mesh_data().data_to_corner_map()->size());
+  if (corner_map_size * num_components > size) {
+    return false;
+  }
   for (int p = 1; p < corner_map_size; ++p) {
     const CornerIndex start_corner_id =
         this->mesh_data().data_to_corner_map()->at(p);

src/draco/compression/attributes/prediction_schemes/mesh_prediction_scheme_geometric_normal_decoder.h

@@ -97,7 +97,7 @@ template <typename DataTypeT, class TransformT, class MeshDataT>
 bool MeshPredictionSchemeGeometricNormalDecoder<
     DataTypeT, TransformT,
     MeshDataT>::ComputeOriginalValues(const CorrType *in_corr,
-                                      DataTypeT *out_data, int /* size */,
+                                      DataTypeT *out_data, int size,
                                       int num_components,
                                       const PointIndex *entry_to_point_id_map) {
   this->SetQuantizationBits(this->transform().quantization_bits());
@@ -109,6 +109,9 @@ bool MeshPredictionSchemeGeometricNormalDecoder<
 
   const int corner_map_size =
       static_cast<int>(this->mesh_data().data_to_corner_map()->size());
+  if (corner_map_size * num_components > size) {
+    return false;
+  }
 
   VectorD<int32_t, 3> pred_normal_3d;
   int32_t pred_normal_oct[2];

src/draco/compression/attributes/prediction_schemes/mesh_prediction_scheme_multi_parallelogram_decoder.h

@@ -59,7 +59,7 @@ template <typename DataTypeT, class TransformT, class MeshDataT>
 bool MeshPredictionSchemeMultiParallelogramDecoder<DataTypeT, TransformT,
                                                    MeshDataT>::
     ComputeOriginalValues(const CorrType *in_corr, DataTypeT *out_data,
-                          int /* size */, int num_components,
+                          int size, int num_components,
                           const PointIndex * /* entry_to_point_id_map */) {
   this->transform().Init(num_components);
 
@@ -76,6 +76,9 @@ bool MeshPredictionSchemeMultiParallelogramDecoder<DataTypeT, TransformT,
 
   const int corner_map_size =
       static_cast<int>(this->mesh_data().data_to_corner_map()->size());
+  if (corner_map_size * num_components > size) {
+    return false;
+  }
   for (int p = 1; p < corner_map_size; ++p) {
     const CornerIndex start_corner_id =
         this->mesh_data().data_to_corner_map()->at(p);

src/draco/compression/attributes/prediction_schemes/mesh_prediction_scheme_parallelogram_decoder.h

@@ -56,7 +56,7 @@ template <typename DataTypeT, class TransformT, class MeshDataT>
 bool MeshPredictionSchemeParallelogramDecoder<DataTypeT, TransformT,
                                               MeshDataT>::
     ComputeOriginalValues(const CorrType *in_corr, DataTypeT *out_data,
-                          int /* size */, int num_components,
+                          int size, int num_components,
                           const PointIndex * /* entry_to_point_id_map */) {
   this->transform().Init(num_components);
 
@@ -72,6 +72,9 @@ bool MeshPredictionSchemeParallelogramDecoder<DataTypeT, TransformT,
 
   const int corner_map_size =
       static_cast<int>(this->mesh_data().data_to_corner_map()->size());
+  if (corner_map_size * num_components > size) {
+    return false;
+  }
   for (int p = 1; p < corner_map_size; ++p) {
     const CornerIndex corner_id = this->mesh_data().data_to_corner_map()->at(p);
     const int dst_offset = p * num_components;

src/draco/compression/point_cloud/point_cloud_sequential_decoder.cc

@@ -24,6 +24,9 @@ bool PointCloudSequentialDecoder::DecodeGeometryData() {
   if (!buffer()->Decode(&num_points)) {
     return false;
   }
+  if (num_points < 0) {
+    return false;
+  }
   point_cloud()->set_num_points(num_points);
   return true;
 }