KhronosGroup / KhronosGroup/OpenCOLLADA
SEGV on unknown address at strlen-avx2.S:65 due to COLLADASaxFWLSourceArrayLoader.cpp:236
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 678
- Forks
- 260
- PR merge metrics
- No merged PRs in 30d
Description
A crafted input leads to crash (an invalid memory address dereference) at strlen-avx2.S:65 in opencolladavalidator v1.6.68 (the latest version, checked on Ubuntu/Debian packages and current master).
Seems the line accessorParameter.type = attributeData.type; in COLLADASaxFWL::SourceArrayLoader::begin__param (COLLADASaxFWLSourceArrayLoader.cpp:236) causes the segmentation fault.
PoC: PoC.zip
Triggered by:
./OpenCOLLADAValidator PoC.dae
ASAN report:
$ ./OpenCOLLADAValidator PoC.dae
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1957786==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ff1b674a675 bp 0x7ffdbe0b8090 sp 0x7ffdbe0b7808 T0)
==1957786==The signal is caused by a READ memory access.
==1957786==Hint: address points to the zero page.
#0 0x7ff1b674a674 (/lib/x86_64-linux-gnu/libc.so.6+0x18b674)
#1 0x7ff1b6d928fb (/lib/x86_64-linux-gnu/libasan.so.5+0x678fb)
#2 0x55a87a400923 in std::char_traits<char>::length(char const*) /usr/include/c++/9/bits/char_traits.h:335
#3 0x55a87a400923 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::assign(char const*) /usr/include/c++/9/bits/basic_string.h:1439
#4 0x55a87a400923 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator=(char const*) /usr/include/c++/9/bits/basic_string.h:705
#5 0x55a87a400923 in COLLADASaxFWL::SourceArrayLoader::begin__param(COLLADASaxFWL::param__AttributeData const&) /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLSourceArrayLoader.cpp:236
#6 0x55a87a1f663e in non-virtual thunk to COLLADASaxFWL::SourceArrayLoader14::begin__param(COLLADASaxFWL14::param__AttributeData const&) (/home/nale/OpenCOLLADA-1.6.63/build/bin/OpenCOLLADAValidator+0x191963e)
#7 0x55a879661812 in GeneratedSaxParser::ParserTemplate<COLLADASaxFWL14::ColladaParserAutoGen14Private, COLLADASaxFWL14::ColladaParserAutoGen14>::elementBegin(char const*, GeneratedSaxParser::ParserAttributes const&) /home/nale/OpenCOLLADA-1.6.63/GeneratedSaxParser/include/GeneratedSaxParserParserTemplate.h:2059
#8 0x55a87a4ca3e0 in GeneratedSaxParser::LibxmlSaxParser::startElement(void*, unsigned char const*, unsigned char const**) /home/nale/OpenCOLLADA-1.6.63/GeneratedSaxParser/src/GeneratedSaxParserLibxmlSaxParser.cpp:179
#9 0x7ff1b6b4915e in xmlParseStartTag (/lib/x86_64-linux-gnu/libxml2.so.2+0x4b15e)
#10 0x7ff1b6b4bf27 (/lib/x86_64-linux-gnu/libxml2.so.2+0x4df27)
#11 0x7ff1b6b517cf in xmlParseContent (/lib/x86_64-linux-gnu/libxml2.so.2+0x537cf)
#12 0x7ff1b6b52f0f in xmlParseDocument (/lib/x86_64-linux-gnu/libxml2.so.2+0x54f0f)
#13 0x55a87a4ca9cf in GeneratedSaxParser::LibxmlSaxParser::parseFile(char const*) /home/nale/OpenCOLLADA-1.6.63/GeneratedSaxParser/src/GeneratedSaxParserLibxmlSaxParser.cpp:103
#14 0x55a8790ba3ca in COLLADASaxFWL::VersionParser::createAndLaunchParser() /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLVersionParser.cpp:329
#15 0x55a8790b7a3e in COLLADASaxFWL::FileLoader::load() /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLFileLoader.cpp:79
#16 0x55a8790482be in COLLADASaxFWL::Loader::loadDocument(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, COLLADAFW::IWriter*) /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLLoader.cpp:226
#17 0x55a8790386f4 in parse(char*, ValidationErrorHandler&) /home/nale/OpenCOLLADA-1.6.63/COLLADAValidator/src/main.cpp:37
#18 0x55a878fe4fbc in main /home/nale/OpenCOLLADA-1.6.63/COLLADAValidator/src/main.cpp:54
#19 0x7ff1b65e60b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
#20 0x55a8790378ad in _start (/home/nale/OpenCOLLADA-1.6.63/build/bin/OpenCOLLADAValidator+0x75a8ad)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x18b674)
==1957786==ABORTING
GDB info:


Environment:
Host Operating System and version: Ubuntu 20.04.2 LTS
Host CPU architecture: x86_64
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the crash with the linked PoC using OpenCOLLADAValidator and AddressSanitizer. Start in COLLADASaxFWLSourceArrayLoader.cpp at SourceArrayLoader::begin__param, line 236, and trace the param attribute handling shown in the report. Done means the crafted COLLADA input no longer causes a segmentation fault during validation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- computer-graphics
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100