AcademySoftwareFoundation / AcademySoftwareFoundation/openvdb

[BUG] AttributeSet::Descriptor::{read,write} has out of bounds memory access when size_t is not 64-bit

Open
#2,174 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C++
Stars
3.4k
Forks
777
Avg merge
3d 9h
Merged PRs (30d)
34

Description

Environment

Operating System: alpine linux 32-bit
Version / Commit SHA: 402b91251cca6d8b46a70205086b923f85bd4814
Other: https://gitlab.alpinelinux.org/sertonix/aports/-/merge_requests/141

Describe the bug

(A clear and concise description of what the bug is.)

In openvdb/openvdb/points/AttributeSet.cc there are 4 calls to reinterpret_cast used to read/write data followed by a sizeof(Index64) for the length even though the actual data is of type size_t. On architectures where size_t is not 64-bit this results in out of bounds memory access. There should be something like sizeof(size_t) or sizeof(it->second) used instead.

To Reproduce

Steps to reproduce the behavior:

  1. Run tests on an alpine linux 32-bit system
  2. The test suite crashes due to stack corruption
Expected behavior

The test suite should not crash and mostly pass.

Additional context

I made a patch which I don't mind being committed with changed authorship but have no interest in signing the CLA: https://github.com/AcademySoftwareFoundation/openvdb/pull/2173

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect the four reinterpret_cast calls in openvdb/openvdb/points/AttributeSet.cc that use sizeof(Index64) for size_t data. Run the test suite on an Alpine Linux 32-bit environment and verify it no longer crashes from stack corruption. Done means the accesses use the actual data size and the tests mostly pass on 32-bit systems.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
computer-graphics
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.