Skip to content

Fix buffer overrun if header specifies more vertices than the file really has#53

Merged
ddiakopoulos merged 1 commit intoddiakopoulos:masterfrom
RamonArguelles:malformedheadermaster
Feb 5, 2022
Merged

Fix buffer overrun if header specifies more vertices than the file really has#53
ddiakopoulos merged 1 commit intoddiakopoulos:masterfrom
RamonArguelles:malformedheadermaster

Conversation

@RamonArguelles
Copy link
Copy Markdown
Contributor

As discussed in here:

There is a buffer overrun when parsing a PLY with a header that specifies more vertices than what the file really has. Aka, if the header says there are 20 vertices, but the contents only have 19, you'll hit the problem.

Looking a little bit into the code, tinyply already uses the information from the header to allocate a buffer that should fit the file contents. The size of the buffer is thus known, but it is not passed all the way down. This PR implements a simple fix that mainly passes the buffer size a couple of frames down into the stack, when we are about to read from the file and copy into the buffer. If we pass the buffer size down, we can check if the copy is going to fit, and if not, throw an exception instead of attempting to reference beyond the buffer.

We tested our local fix with both master and 2.4 branches, and it does seem to work in both cases.

@ddiakopoulos
Copy link
Copy Markdown
Owner

Than you @RamonArguelles !

@ddiakopoulos ddiakopoulos merged commit 0950d03 into ddiakopoulos:master Feb 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants