v4games
/
assimp
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix buffer overflow in obj loader 

The overflow-checking code in ObjFileImporter::createVertexArray is at
the wrong position, allowing buffer overflows in preceding code.

This fix moves the code to the right spot.

An actual overflow can be caused by usign some more bugs and weird
behaviours and injecting a malformed line statement into the object
file, containing only one index. Such a malformed file could for
example look like:

o 1

v 0 0 0
v 1 1 1
v 2 2 2

l 1
f 1 2 3

Because the code in ObjFileImporter::createTopology incorrectly handles
line-type faces containing only one index (in line 364), it
underestimates the number of required indices and therefore causes the
buffer allocated in line 421 to be too small.

I believe, the correct fix for this would be in the parser and
rejecting such faces early. However the overflow check was misplaced
anyway.

If you can't reproduce a crash, just insert some more "l 1" lines
before the "f 1 2 3" line until it crashes. The behaviour of heap buffer
overflows strongly depends on memory layout and allocation history.
pull/1654/head
Faule Socke 2017-12-23 17:34:39 +01:00
parent dd3cb74b21
commit 4a65e76ca7
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
code/ObjFileImporter.cpp
View File

@ -448,6 +448,10 @@ void ObjFileImporter::createVertexArray(const ObjFile::Model* pModel,
throw DeadlyImportError( "OBJ: vertex index out of range" );
}
if ( pMesh->mNumVertices <= newIndex ) {
throw DeadlyImportError("OBJ: bad vertex index");
}
pMesh->mVertices[ newIndex ] = pModel->m_Vertices[ vertex ];
// Copy all normals
@ -479,10 +483,6 @@ void ObjFileImporter::createVertexArray(const ObjFile::Model* pModel,
pMesh->mTextureCoords[ 0 ][ newIndex ] = aiVector3D( coord3d.x, coord3d.y, coord3d.z );
}
if ( pMesh->mNumVertices <= newIndex ) {
throw DeadlyImportError("OBJ: bad vertex index");
}
// Get destination face
aiFace *pDestFace = &pMesh->mFaces[ outIndex ];