KhronosGroup / KhronosGroup/OpenCOLLADA

SEGV on unknown address at strlen-avx2.S:65 due to COLLADASaxFWLSourceArrayLoader.cpp:236

Open
#644 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
678
Forks
260
PR merge metrics
No merged PRs in 30d

Description

A crafted input leads to crash (an invalid memory address dereference) at strlen-avx2.S:65 in opencolladavalidator v1.6.68 (the latest version, checked on Ubuntu/Debian packages and current master).
Seems the line accessorParameter.type = attributeData.type; in COLLADASaxFWL::SourceArrayLoader::begin__param (COLLADASaxFWLSourceArrayLoader.cpp:236) causes the segmentation fault.

PoC: PoC.zip

Triggered by:

./OpenCOLLADAValidator PoC.dae

ASAN report:

$ ./OpenCOLLADAValidator PoC.dae
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1957786==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ff1b674a675 bp 0x7ffdbe0b8090 sp 0x7ffdbe0b7808 T0)
==1957786==The signal is caused by a READ memory access.
==1957786==Hint: address points to the zero page.
    #0 0x7ff1b674a674  (/lib/x86_64-linux-gnu/libc.so.6+0x18b674)
    #1 0x7ff1b6d928fb  (/lib/x86_64-linux-gnu/libasan.so.5+0x678fb)
    #2 0x55a87a400923 in std::char_traits<char>::length(char const*) /usr/include/c++/9/bits/char_traits.h:335
    #3 0x55a87a400923 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::assign(char const*) /usr/include/c++/9/bits/basic_string.h:1439
    #4 0x55a87a400923 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator=(char const*) /usr/include/c++/9/bits/basic_string.h:705
    #5 0x55a87a400923 in COLLADASaxFWL::SourceArrayLoader::begin__param(COLLADASaxFWL::param__AttributeData const&) /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLSourceArrayLoader.cpp:236
    #6 0x55a87a1f663e in non-virtual thunk to COLLADASaxFWL::SourceArrayLoader14::begin__param(COLLADASaxFWL14::param__AttributeData const&) (/home/nale/OpenCOLLADA-1.6.63/build/bin/OpenCOLLADAValidator+0x191963e)
    #7 0x55a879661812 in GeneratedSaxParser::ParserTemplate<COLLADASaxFWL14::ColladaParserAutoGen14Private, COLLADASaxFWL14::ColladaParserAutoGen14>::elementBegin(char const*, GeneratedSaxParser::ParserAttributes const&) /home/nale/OpenCOLLADA-1.6.63/GeneratedSaxParser/include/GeneratedSaxParserParserTemplate.h:2059
    #8 0x55a87a4ca3e0 in GeneratedSaxParser::LibxmlSaxParser::startElement(void*, unsigned char const*, unsigned char const**) /home/nale/OpenCOLLADA-1.6.63/GeneratedSaxParser/src/GeneratedSaxParserLibxmlSaxParser.cpp:179
    #9 0x7ff1b6b4915e in xmlParseStartTag (/lib/x86_64-linux-gnu/libxml2.so.2+0x4b15e)
    #10 0x7ff1b6b4bf27  (/lib/x86_64-linux-gnu/libxml2.so.2+0x4df27)
    #11 0x7ff1b6b517cf in xmlParseContent (/lib/x86_64-linux-gnu/libxml2.so.2+0x537cf)
    #12 0x7ff1b6b52f0f in xmlParseDocument (/lib/x86_64-linux-gnu/libxml2.so.2+0x54f0f)
    #13 0x55a87a4ca9cf in GeneratedSaxParser::LibxmlSaxParser::parseFile(char const*) /home/nale/OpenCOLLADA-1.6.63/GeneratedSaxParser/src/GeneratedSaxParserLibxmlSaxParser.cpp:103
    #14 0x55a8790ba3ca in COLLADASaxFWL::VersionParser::createAndLaunchParser() /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLVersionParser.cpp:329
    #15 0x55a8790b7a3e in COLLADASaxFWL::FileLoader::load() /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLFileLoader.cpp:79
    #16 0x55a8790482be in COLLADASaxFWL::Loader::loadDocument(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, COLLADAFW::IWriter*) /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLLoader.cpp:226
    #17 0x55a8790386f4 in parse(char*, ValidationErrorHandler&) /home/nale/OpenCOLLADA-1.6.63/COLLADAValidator/src/main.cpp:37
    #18 0x55a878fe4fbc in main /home/nale/OpenCOLLADA-1.6.63/COLLADAValidator/src/main.cpp:54
    #19 0x7ff1b65e60b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #20 0x55a8790378ad in _start (/home/nale/OpenCOLLADA-1.6.63/build/bin/OpenCOLLADAValidator+0x75a8ad)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x18b674) 
==1957786==ABORTING

GDB info:

image

image

Environment:
Host Operating System and version: Ubuntu 20.04.2 LTS
Host CPU architecture: x86_64

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the crash with the linked PoC using OpenCOLLADAValidator and AddressSanitizer. Start in COLLADASaxFWLSourceArrayLoader.cpp at SourceArrayLoader::begin__param, line 236, and trace the param attribute handling shown in the report. Done means the crafted COLLADA input no longer causes a segmentation fault during validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
computer-graphics
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.