AcademySoftwareFoundation / AcademySoftwareFoundation/openvdb
[BUG] AttributeSet::Descriptor::{read,write} has out of bounds memory access when size_t is not 64-bit
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 3.4k
- Forks
- 777
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 34
Description
Environment
Operating System: alpine linux 32-bit
Version / Commit SHA: 402b91251cca6d8b46a70205086b923f85bd4814
Other: https://gitlab.alpinelinux.org/sertonix/aports/-/merge_requests/141
Describe the bug
(A clear and concise description of what the bug is.)
In openvdb/openvdb/points/AttributeSet.cc there are 4 calls to reinterpret_cast used to read/write data followed by a sizeof(Index64) for the length even though the actual data is of type size_t. On architectures where size_t is not 64-bit this results in out of bounds memory access. There should be something like sizeof(size_t) or sizeof(it->second) used instead.
To Reproduce
Steps to reproduce the behavior:
- Run tests on an alpine linux 32-bit system
- The test suite crashes due to stack corruption
Expected behavior
The test suite should not crash and mostly pass.
Additional context
I made a patch which I don't mind being committed with changed authorship but have no interest in signing the CLA: https://github.com/AcademySoftwareFoundation/openvdb/pull/2173
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the four reinterpret_cast calls in openvdb/openvdb/points/AttributeSet.cc that use sizeof(Index64) for size_t data. Run the test suite on an Alpine Linux 32-bit environment and verify it no longer crashes from stack corruption. Done means the accesses use the actual data size and the tests mostly pass on 32-bit systems.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- computer-graphics
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100