assimp MD5Importer heap-buffer-overflow write in MakeDataUnique

Vulnerability Overview Title: Fix heap-buffer-overflow write in MD5 MakeDataUnique #6718 Status: Merged by into from the source branch . Vulnerability Type: Heap-buffer-overflow write. Root Cause: duplicates shared vertices, ensuring each triangle has its own three vertices. The original code set the output array size to , but the append cursor started from the original vertex count. When more vertices were referenced (i.e., start value exceeded the adjusted array size), the first duplicate write would fall outside the heap allocation. Impact Affects the model import flow ( / ). Malformed or vertex-heavy MD5 files could trigger out-of-bounds writes, corrupting heap memory, leading to crashes or data corruption. After the fix, importing well-formed MD5 files remains unchanged; malformed files now fail cleanly ( ) or import within bounds, no longer corrupting the heap. Fix Adjusted the vertex array size to the true worst case: (at most one duplicate appended per vertex), and used to shrink back to the end of the actual generated. Validated indices against (the allocated size) rather than the post-resize array size; previous checks were based on the post-resize size, which could be out of bounds. Used a zero-initialized original vertex count as the upper bound to protect per-vertex weight estimation (avoiding division by zero, negative values, or reserved areas). Key Code (Pre-fix AddressSanitizer Report) Verification / POC Fuzzed the MD5 importer using AddressSanitizer + libFuzzer; after the fix, the reproducing case no longer triggers ASan, and subsequent coverage-guided fuzzing did not uncover further overflows along this path. Summarized via CodeRabbit: the fix resolves crashes when importing specific MD5 models, improving validation and memory safety for MD5 import, preventing out-of-bounds accesses and reliably handling vertex and face data.

Goal Reached Thanks to every supporter — we hit 100%!

assimp MD5Importer heap-buffer-overflow write in MakeDataUnique

More from this source