assimp/CVE-2024-53425-pre-Fix-Add-check-for-invalid-input-argument.patch

197 lines
7.1 KiB
Diff

From d7cde433679a6e21e0a5f22e54ea0951783503fe Mon Sep 17 00:00:00 2001
From: Kim Kulling <kim.kullingk@draeger.com>
Date: Mon, 2 Oct 2023 10:24:43 +0200
Subject: [PATCH] Fix: Add check for invalid input argument
---
code/AssetLib/MD5/MD5Parser.cpp | 10 +++---
code/AssetLib/MD5/MD5Parser.h | 62 ++++++++++++++++++---------------
2 files changed, 38 insertions(+), 34 deletions(-)
diff --git a/code/AssetLib/MD5/MD5Parser.cpp b/code/AssetLib/MD5/MD5Parser.cpp
index 7d0b41c24a..8da30e28f7 100644
--- a/code/AssetLib/MD5/MD5Parser.cpp
+++ b/code/AssetLib/MD5/MD5Parser.cpp
@@ -3,7 +3,7 @@
Open Asset Import Library (assimp)
---------------------------------------------------------------------------
-Copyright (c) 2006-2022, assimp team
+Copyright (c) 2006-2023, assimp team
All rights reserved.
@@ -87,7 +87,7 @@ MD5Parser::MD5Parser(char *_buffer, unsigned int _fileSize) : buffer(_buffer), b
// ------------------------------------------------------------------------------------------------
// Report error to the log stream
-/*static*/ AI_WONT_RETURN void MD5Parser::ReportError(const char *error, unsigned int line) {
+AI_WONT_RETURN void MD5Parser::ReportError(const char *error, unsigned int line) {
char szBuffer[1024];
::ai_snprintf(szBuffer, 1024, "[MD5] Line %u: %s", line, error);
throw DeadlyImportError(szBuffer);
@@ -95,7 +95,7 @@ MD5Parser::MD5Parser(char *_buffer, unsigned int _fileSize) : buffer(_buffer), b
// ------------------------------------------------------------------------------------------------
// Report warning to the log stream
-/*static*/ void MD5Parser::ReportWarning(const char *warn, unsigned int line) {
+void MD5Parser::ReportWarning(const char *warn, unsigned int line) {
char szBuffer[1024];
::snprintf(szBuffer, sizeof(szBuffer), "[MD5] Line %u: %s", line, warn);
ASSIMP_LOG_WARN(szBuffer);
@@ -122,8 +122,8 @@ void MD5Parser::ParseHeader() {
// print the command line options to the console
// FIX: can break the log length limit, so we need to be careful
char *sz = buffer;
- while (!IsLineEnd(*buffer++))
- ;
+ while (!IsLineEnd(*buffer++));
+
ASSIMP_LOG_INFO(std::string(sz, std::min((uintptr_t)MAX_LOG_MESSAGE_LENGTH, (uintptr_t)(buffer - sz))));
SkipSpacesAndLineEnd();
}
diff --git a/code/AssetLib/MD5/MD5Parser.h b/code/AssetLib/MD5/MD5Parser.h
index ad7367e2ab..9b29fbe851 100644
--- a/code/AssetLib/MD5/MD5Parser.h
+++ b/code/AssetLib/MD5/MD5Parser.h
@@ -2,8 +2,7 @@
Open Asset Import Library (assimp)
----------------------------------------------------------------------
-Copyright (c) 2006-2022, assimp team
-
+Copyright (c) 2006-2023, assimp team
All rights reserved.
@@ -93,7 +92,7 @@ struct Section {
std::string mName;
//! For global elements: the value of the element as string
- //! Iif !length() the section is not a global element
+ //! if !length() the section is not a global element
std::string mGlobalValue;
};
@@ -185,7 +184,7 @@ using FrameList = std::vector<FrameDesc>;
*/
struct VertexDesc {
VertexDesc() AI_NO_EXCEPT
- : mFirstWeight(0), mNumWeights(0) {
+ : mFirstWeight(0), mNumWeights(0) {
// empty
}
@@ -349,62 +348,61 @@ class MD5Parser {
*/
MD5Parser(char* buffer, unsigned int fileSize);
-
// -------------------------------------------------------------------
/** Report a specific error message and throw an exception
* @param error Error message to be reported
* @param line Index of the line where the error occurred
*/
- AI_WONT_RETURN static void ReportError (const char* error, unsigned int line) AI_WONT_RETURN_SUFFIX;
+ AI_WONT_RETURN static void ReportError(const char* error, unsigned int line) AI_WONT_RETURN_SUFFIX;
// -------------------------------------------------------------------
/** Report a specific warning
* @param warn Warn message to be reported
* @param line Index of the line where the error occurred
*/
- static void ReportWarning (const char* warn, unsigned int line);
-
+ static void ReportWarning(const char* warn, unsigned int line);
+ // -------------------------------------------------------------------
+ /** Report a specific error
+ * @param error Error message to be reported
+ */
AI_WONT_RETURN void ReportError (const char* error) AI_WONT_RETURN_SUFFIX;
- void ReportWarning (const char* warn) {
- return ReportWarning(warn, lineNumber);
- }
+ // -------------------------------------------------------------------
+ /** Report a specific warning
+ * @param error Warn message to be reported
+ */
+ void ReportWarning (const char* warn);
//! List of all sections which have been read
SectionList mSections;
private:
- // -------------------------------------------------------------------
- /** Parses a file section. The current file pointer must be outside
- * of a section.
- * @param out Receives the section data
- * @return true if the end of the file has been reached
- * @throws ImportErrorException if an error occurs
- */
bool ParseSection(Section& out);
-
- // -------------------------------------------------------------------
- /** Parses the file header
- * @throws ImportErrorException if an error occurs
- */
void ParseHeader();
-
bool SkipLine(const char* in, const char** out);
bool SkipLine( );
bool SkipSpacesAndLineEnd( const char* in, const char** out);
bool SkipSpacesAndLineEnd();
bool SkipSpaces();
+private:
char* buffer;
char* bufferEnd;
unsigned int fileSize;
unsigned int lineNumber;
};
+// -------------------------------------------------------------------
+inline void MD5Parser::ReportWarning (const char* warn) {
+ return ReportWarning(warn, lineNumber);
+}
+
+// -------------------------------------------------------------------
inline void MD5Parser::ReportError(const char* error) {
ReportError(error, lineNumber);
}
+
// -------------------------------------------------------------------
inline bool MD5Parser::SkipLine(const char* in, const char** out) {
++lineNumber;
@@ -418,18 +416,24 @@ inline bool MD5Parser::SkipLine( ) {
// -------------------------------------------------------------------
inline bool MD5Parser::SkipSpacesAndLineEnd( const char* in, const char** out) {
- bool bHad = false;
- bool running = true;
+ if (in == bufferEnd) {
+ *out = in;
+ return false;
+ }
+
+ bool bHad = false, running = true;
while (running) {
if( *in == '\r' || *in == '\n') {
- // we open files in binary mode, so there could be \r\n sequences ...
+ // we open files in binary mode, so there could be \r\n sequences ...
if (!bHad) {
bHad = true;
++lineNumber;
}
+ } else if (*in == '\t' || *in == ' ') {
+ bHad = false;
+ } else {
+ break;
}
- else if (*in == '\t' || *in == ' ')bHad = false;
- else break;
++in;
if (in == bufferEnd) {
break;