Skip to content

fix: integer overflow in face/point count multiplications → heap overflow #1166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mohammadmseet-hue wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: integer overflow in face/point count multiplications → heap overflow #1166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion src/draco/javascript/emscripten/decoder_webidl_wrapper.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,11 @@ template <typename T>
bool GetTrianglesArray(const draco::Mesh &m, const int out_size,
T *out_values) {
const uint32_t num_faces = m.num_faces();
if (num_faces * 3 * sizeof(T) != out_size) {
// Check for integer overflow before size comparison.
const uint64_t required_size =
static_cast<uint64_t>(num_faces) * 3 * sizeof(T);
if (required_size > static_cast<uint64_t>(out_size) ||
static_cast<int>(required_size) != out_size) {
return false;
}

Expand Down
4 changes: 4 additions & 0 deletions src/draco/maya/draco_maya_plugin.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,10 @@ namespace maya {
static void decode_faces(std::unique_ptr<draco::Mesh> &drc_mesh,
Drc2PyMesh *out_mesh) {
int num_faces = drc_mesh->num_faces();
// Check for integer overflow in num_faces * 3.
if (num_faces < 0 || static_cast<uint64_t>(num_faces) * 3 > SIZE_MAX / sizeof(int)) {
return;
}
out_mesh->faces = new int[num_faces * 3];
out_mesh->faces_num = num_faces;
for (int i = 0; i < num_faces; i++) {
Expand Down
14 changes: 14 additions & 0 deletions src/draco/unity/draco_unity_plugin.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,6 +236,10 @@ bool EXPORT_API GetMeshIndices(const DracoMesh *mesh, DracoData **indices) {
return false;
}
const Mesh *const m = static_cast<const Mesh *>(mesh->private_mesh);
// Check for integer overflow in num_faces * 3.
if (m->num_faces() > SIZE_MAX / 3 / sizeof(int)) {
return false;
}
int *const temp_indices = new int[m->num_faces() * 3];
for (draco::FaceIndex face_id(0); face_id < m->num_faces(); ++face_id) {
const Mesh::Face &face = m->face(draco::FaceIndex(face_id));
Expand Down Expand Up @@ -328,6 +332,11 @@ int DecodeMeshForUnity(char *data, unsigned int length,
unity_mesh->num_faces = in_mesh->num_faces();
unity_mesh->num_vertices = in_mesh->num_points();

// Check for integer overflow in num_faces * 3.
if (in_mesh->num_faces() > SIZE_MAX / 3 / sizeof(int)) {
ReleaseUnityMesh(&unity_mesh);
return -4;
}
unity_mesh->indices = new int[in_mesh->num_faces() * 3];
for (draco::FaceIndex face_id(0); face_id < in_mesh->num_faces(); ++face_id) {
const Mesh::Face &face = in_mesh->face(draco::FaceIndex(face_id));
Expand All @@ -336,6 +345,11 @@ int DecodeMeshForUnity(char *data, unsigned int length,
}

// TODO(draco-eng): Add other attributes.
// Check for integer overflow in num_points * components * sizeof(float).
if (in_mesh->num_points() > SIZE_MAX / 4 / sizeof(float)) {
ReleaseUnityMesh(&unity_mesh);
return -4;
}
unity_mesh->position = new float[in_mesh->num_points() * 3];
const auto pos_att =
in_mesh->GetNamedAttribute(draco::GeometryAttribute::POSITION);
Expand Down