Application crash via zero animation count

Heap buffer over-read in Assimp 6.0.0 through 6.0.4 allows local users to crash applications by importing a crafted Half-Life 1 MDL file. HL1MDLLoader::extract_anim_value fails to reject a zero num.total field, so its loop never terminates and advances panimvalue beyond the allocated heap buffer. Exploitation requires a target application to process the malicious model locally; the published proof of concept demonstrates an out-of-bounds read and process abort, not code execution.