Fix RapidJSON null allocator deref in schema validator

[SergioRZMasson]

Apply a small CMake patch script during the RapidJSON ExternalProject_Add download step to fix CWE-476: null pointer dereference in GenericSchemaValidator::EndMissingDependentProperties() (replaces &GetInvalidSchemaPointer().GetAllocator() with &GetStateAllocator()).

Adds regression tests for the missing-dependent-property crash and a Linux Clang ASAN/UBSAN sanitizer CI workflow.

[Copilot]

Pull request overview

This PR mitigates a RapidJSON schema validator null-pointer dereference (CWE-476) by applying a small CMake-based patch during RapidJSON’s ExternalProject_Add download step, and adds regression coverage plus a Linux Clang ASAN/UBSAN CI job to catch similar issues.

Changes:

• Add two regression tests for missing-dependent-property schema validation failures.
• Introduce a CMake patch script to modify RapidJSON’s schema.h during external download.
• Add a reusable GitHub Actions sanitizer workflow and wire it into the main CI workflow.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
GLTFSDK.Test/Source/DeserializeTests.cpp	Adds malformed JSON inputs and regression tests expecting ValidationException instead of a crash.
External/RapidJSON/patches/fix-null-allocator-deref.cmake	Adds a CMake script to patch RapidJSON schema.h to avoid null allocator deref.
External/RapidJSON/CMakeRapidJSONDownload.txt.in	Runs the patch script via PATCH_COMMAND during RapidJSON ExternalProject_Add.
.github/workflows/sanitizer.yml	Adds a workflow to build with Clang + ASAN/UBSAN and run unit tests on Linux.
.github/workflows/ci.yml	Adds a sanitizer job that calls the new sanitizer workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bghgary]

[Reviewed by Copilot on behalf of @bghgary]

The fix is correct and the sanitizer CI is a nice add. Agree with all four of Copilot's inline comments.

The biggest one is #2 — string(FIND ... -1) returns STATUS instead of FATAL_ERROR when neither pattern is present. Combined with the GIT_TAG pin, a future RapidJSON bump can silently regress the security fix. Three states should be distinguished:

• &GetStateAllocator() already present → already patched, return STATUS.
• &GetInvalidSchemaPointer().GetAllocator() present → apply patch.
• Neither → FATAL_ERROR.

#4 — c_missingDependentPropertyBufferView duplicates the existing c_invalidAccessorDependency; reuse it.

One nit beyond Copilot's comments: ASAN_OPTIONS: detect_leaks=0 disables leak detection. Intentional or just template default? Worth flipping to 1 if there's no reason to skip.

Approve once #2 and #4 are addressed.

Switching verdict to approve