add wearables array size checks on unpack

2 files changed, 18 insertions, 3 deletions

diff --git a/OpenSim/Framework/AvatarAppearance.cs b/OpenSim/Framework/AvatarAppearance.cs
index a34c85f..55e4b40 100644
--- a/OpenSim/Framework/AvatarAppearance.cs
+++ b/OpenSim/Framework/AvatarAppearance.cs
@@ -458,7 +458,12 @@ namespace OpenSim.Framework
 //          m_log.WarnFormat("[AVATARAPPEARANCE] set wearable {0} --> {1}:{2}",wearableId,wearable.ItemID,wearable.AssetID);
 // DEBUG OFF
             m_wearables[wearableId].Clear();
-            for (int i = 0; i < wearable.Count; i++)
+
+            int count = wearable.Count;
+            if (count > AvatarWearable.MAX_WEARABLES)
+                count = AvatarWearable.MAX_WEARABLES;
+
+            for (int i = 0; i < count; i++)
                 m_wearables[wearableId].Add(wearable[i].ItemID, wearable[i].AssetID);
         }
 
@@ -751,7 +756,12 @@ namespace OpenSim.Framework
                 if ((data != null) && (data["wearables"] != null) && (data["wearables"]).Type == OSDType.Array)
                 {
                     OSDArray wears = (OSDArray)(data["wearables"]);
-                    for (int i = 0; i < wears.Count; i++)
+
+                    int count = wears.Count;
+                    if (count > AvatarWearable.MAX_WEARABLES)
+                        count = AvatarWearable.MAX_WEARABLES;
+
+                    for (int i = 0; i < count; i++)
                         m_wearables[i] = new AvatarWearable((OSDArray)wears[i]);
                 }
                 else
diff --git a/OpenSim/Framework/ChildAgentDataUpdate.cs b/OpenSim/Framework/ChildAgentDataUpdate.cs
index 8c32734..967278e 100644
--- a/OpenSim/Framework/ChildAgentDataUpdate.cs
+++ b/OpenSim/Framework/ChildAgentDataUpdate.cs
@@ -657,7 +657,12 @@ namespace OpenSim.Framework
             if ((args["wearables"] != null) && (args["wearables"]).Type == OSDType.Array)
             {
                 OSDArray wears = (OSDArray)(args["wearables"]);
-                for (int i = 0; i < wears.Count / 2; i++) 
+
+                int count = wears.Count;
+                if (count > AvatarWearable.MAX_WEARABLES)
+                    count = AvatarWearable.MAX_WEARABLES;
+
+                for (int i = 0; i < count / 2; i++) 
                 {
                     AvatarWearable awear = new AvatarWearable((OSDArray)wears[i]);
                     Appearance.SetWearable(i,awear);