From df2e7208fbca1b609f20e994d5829a419d17a924 Mon Sep 17 00:00:00 2001 From: Kim Kulling Date: Mon, 26 Jul 2021 11:56:26 +0200 Subject: [PATCH 1/4] Fix fuzzer issue in m3d-importer - closes https://github.com/assimp/assimp/issues/3974 - Check for nullptr before dereferencing name in m3d-data-instance. --- code/AssetLib/M3D/M3DWrapper.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/code/AssetLib/M3D/M3DWrapper.h b/code/AssetLib/M3D/M3DWrapper.h index 54d7a2eec..d5fc9eaa5 100644 --- a/code/AssetLib/M3D/M3DWrapper.h +++ b/code/AssetLib/M3D/M3DWrapper.h @@ -83,7 +83,11 @@ public: // Name inline std::string Name() const { - if (m3d_) return std::string(m3d_->name); + if (nullptr != m3d_) { + if (nullptr!0m3d_->name) { + return std::string(m3d_->name); + } + } return std::string(); } From 291c0a4faa37581e056b43d882e92556cbdc98f1 Mon Sep 17 00:00:00 2001 From: Kim Kulling Date: Mon, 26 Jul 2021 13:13:21 +0200 Subject: [PATCH 2/4] Fix build failure - Fix the failure - Put inlined stuff out of declaration - Add some docu --- code/AssetLib/M3D/M3DWrapper.h | 68 +++++++++++++++++++++++----------- 1 file changed, 46 insertions(+), 22 deletions(-) diff --git a/code/AssetLib/M3D/M3DWrapper.h b/code/AssetLib/M3D/M3DWrapper.h index d5fc9eaa5..96db9c8dd 100644 --- a/code/AssetLib/M3D/M3DWrapper.h +++ b/code/AssetLib/M3D/M3DWrapper.h @@ -46,6 +46,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #ifndef AI_M3DWRAPPER_H_INC #define AI_M3DWRAPPER_H_INC + #if !(ASSIMP_BUILD_NO_EXPORT || ASSIMP_BUILD_NO_M3D_EXPORTER) || !ASSIMP_BUILD_NO_M3D_IMPORTER #include @@ -62,45 +63,68 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #include "m3d.h" namespace Assimp { + class IOSystem; +/// brief The M3D-Wrapper, provudes c++ access to the data. class M3DWrapper { - m3d_t *m3d_ = nullptr; - unsigned char *saved_output_ = nullptr; - public: - // Construct an empty M3D model + /// Construct an empty M3D model explicit M3DWrapper(); - // Construct an M3D model from provided buffer - // NOTE: The m3d.h SDK function does not mark the data as const. Have assumed it does not write. - // BUG: SECURITY: The m3d.h SDK cannot be informed of the buffer size. BUFFER OVERFLOW IS CERTAIN + /// Construct an M3D model from provided buffer + /// @note The m3d.h SDK function does not mark the data as const. Have assumed it does not write. + /// BUG: SECURITY: The m3d.h SDK cannot be informed of the buffer size. BUFFER OVERFLOW IS CERTAIN explicit M3DWrapper(IOSystem *pIOHandler, const std::vector &buffer); - ~M3DWrapper(); + /// Theclasss destructor. + ~M3DWrapper(); - void reset(); + /// Will reset the wrapper, all data will become nullptr. + void reset(); - // Name - inline std::string Name() const { - if (nullptr != m3d_) { - if (nullptr!0m3d_->name) { - return std::string(m3d_->name); - } - } - return std::string(); - } + // The Name access, empty string returned when no m3d instance. + std::string Name() const; - // Execute a save + /// Executes a save. unsigned char *Save(int quality, int flags, unsigned int &size); + + /// Clearer void ClearSave(); - inline explicit operator bool() const { return m3d_ != nullptr; } + /// True for m3d instance exists. + explicit operator bool() const; // Allow direct access to M3D API - inline m3d_t *operator->() const { return m3d_; } - inline m3d_t *M3D() const { return m3d_; } + m3d_t *operator->(); + m3d_t *M3D() const; + +private: + m3d_t *m3d_ = nullptr; + unsigned char *saved_output_ = nullptr; }; + +inline std::string M3DWrapper::Name() const { + if (nullptr != m3d_) { + if (nullptr != m3d_->name) { + return std::string(m3d_->name); + } + } + return std::string(); +} + +inline explicit operator M3DWrapper::bool() const { + return m3d_ != nullptr; +} + +inline m3d_t *M3DWrapper::operator->() const { + return m3d_; +} + +inline m3d_t *M3DWrapper::M3D() const { + return m3d_; +} + } // namespace Assimp #endif From e8e720d584813ad41703e9e96f1798f7ad11b360 Mon Sep 17 00:00:00 2001 From: Kim Kulling Date: Mon, 26 Jul 2021 13:41:54 +0200 Subject: [PATCH 3/4] Update M3DWrapper.h --- code/AssetLib/M3D/M3DWrapper.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code/AssetLib/M3D/M3DWrapper.h b/code/AssetLib/M3D/M3DWrapper.h index 96db9c8dd..83bbdfb85 100644 --- a/code/AssetLib/M3D/M3DWrapper.h +++ b/code/AssetLib/M3D/M3DWrapper.h @@ -113,7 +113,7 @@ inline std::string M3DWrapper::Name() const { return std::string(); } -inline explicit operator M3DWrapper::bool() const { +inline M3DWrapper::operator bool() const { return m3d_ != nullptr; } From aeae2cf242046bfe16a0e4c15e52e7651da45f62 Mon Sep 17 00:00:00 2001 From: Kim Kulling Date: Mon, 26 Jul 2021 14:44:26 +0200 Subject: [PATCH 4/4] Update M3DWrapper.h --- code/AssetLib/M3D/M3DWrapper.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code/AssetLib/M3D/M3DWrapper.h b/code/AssetLib/M3D/M3DWrapper.h index 83bbdfb85..ba838d71d 100644 --- a/code/AssetLib/M3D/M3DWrapper.h +++ b/code/AssetLib/M3D/M3DWrapper.h @@ -96,7 +96,7 @@ public: explicit operator bool() const; // Allow direct access to M3D API - m3d_t *operator->(); + m3d_t *operator->() const; m3d_t *M3D() const; private: