Fix OOB reads in sequential mesh decoder and rANS entropy decoder - #1221
Open
smoke-wolf wants to merge 1 commit into
Open
Fix OOB reads in sequential mesh decoder and rANS entropy decoder#1221smoke-wolf wants to merge 1 commit into
smoke-wolf wants to merge 1 commit into
Conversation
mesh_sequential_decoder.cc: face vertex indices decoded from the bitstream were not validated against num_points, allowing crafted meshes to reference nonexistent vertices. Subsequent attribute access via these indices causes heap-buffer-overflow. Add bounds checking for all face index decode paths. ans.h: RAnsDecoder::read_init() was missing a bounds check for the x==3 case (offset < 4), unlike the x==1 and x==2 cases which had equivalent guards. A crafted entropy stream with offset=1 and x=3 reads 4 bytes before the buffer start. Add the missing check. Both bugs confirmed under AddressSanitizer.
Author
|
Discovered by Maliq Barnard. ASAN-confirmed heap-buffer-overflow in sequential mesh decoder (unvalidated face indices) and rANS entropy decoder (missing bounds check for x==3 case) via crafted .drc files. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two out-of-bounds read bugs in the Draco decoder, both confirmed under AddressSanitizer.
Bug 1: Face index validation missing in sequential decoder
mesh_sequential_decoder.cc— face vertex indices decoded from the bitstream are not validated againstnum_points. A crafted.drcfile with face indices exceeding the vertex count causes heap-buffer-overflow when attributes are accessed via the invalid indices.Fix: Add
if (val >= num_points) return false;to all four face index decode paths (uint8, uint16, varint, uint32).Bug 2: Missing bounds check in rANS decoder
read_init()ans.h—RAnsDecoder::read_init()checksoffset < 2for x==1 andoffset < 3for x==2, but is missing the equivalentoffset < 4check for x==3. A crafted entropy stream reads 4 bytes before the buffer start.Fix: Add
if (offset < 4) return 1;for the x==3 case, matching the existing pattern.