KhronosGroup / KhronosGroup/OpenCOLLADA

SEGV on unknown address due to COLLADABUURI.cpp:225

Open
#645 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
679
Forks
260
PR merge metrics
No merged PRs in 30d

Description

A crafted input leads to crash (an invalid memory address dereference) at std::__cxx11::basic_string... in libstdc++.so.6 provided by opencolladavalidator `v1.6.68` (the latest version, checked on Ubuntu/Debian packages and current master).
Seems the line `mUriString = copyFrom_.mUriString;` in COLLADABUURI.cpp:225 causes the segmentation fault.

PoC: [PoC.zip](https://github.com/KhronosGroup/OpenCOLLADA/files/6176308/PoC.zip)

Triggered by:

`./OpenCOLLADAValidator PoC.dae`

ASAN report:

```
$ ./OpenCOLLADAValidator PoC.dae
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2010438==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x7f2b14ed0d3c bp 0x7ffe7c9da9f0 sp 0x7ffe7c9da470 T0)
==2010438==The signal is caused by a READ memory access.
==2010438==Hint: address points to the zero page.
#0 0x7f2b14ed0d3b in std::__cxx11::basic_string, std::allocator >::_M_assign(std::__cxx11::basic_string, std::allocator > const&) (/lib/x86_64-linux-gnu/libstdc++.so.6+0x142d3b)
#1 0x557c59f7c672 in std::__cxx11::basic_string, std::allocator >::assign(std::__cxx11::basic_string, std::allocator > const&) /usr/include/c++/9/bits/basic_string.h:1366
#2 0x557c59f7c672 in std::__cxx11::basic_string, std::allocator >::operator=(std::__cxx11::basic_string, std::allocator > const&) /usr/include/c++/9/bits/basic_string.h:696
#3 0x557c59f7c672 in COLLADABU::URI::URI(COLLADABU::URI const&, bool) /home/nale/OpenCOLLADA-1.6.63/COLLADABaseUtils/src/COLLADABUURI.cpp:225
#4 0x557c59e9264f in COLLADASaxFWL::MeshLoader::initializePositionsOffset() /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLMeshLoader.cpp:754
#5 0x557c59ea1de9 in COLLADASaxFWL::MeshLoader::initializeOffsets() /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLMeshLoader.cpp:731
#6 0x557c59ea21b1 in COLLADASaxFWL::MeshLoader::begin__p() /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLMeshLoader.cpp:1464
#7 0x557c5907c812 in GeneratedSaxParser::ParserTemplate::elementBegin(char const*, GeneratedSaxParser::ParserAttributes const&) /home/nale/OpenCOLLADA-1.6.63/GeneratedSaxParser/include/GeneratedSaxParserParserTemplate.h:2059
#8 0x557c59ee53e0 in GeneratedSaxParser::LibxmlSaxParser::startElement(void*, unsigned char const*, unsigned char const**) /home/nale/OpenCOLLADA-1.6.63/GeneratedSaxParser/src/GeneratedSaxParserLibxmlSaxParser.cpp:179
#9 0x7f2b14fba5a6 in xmlParseStartTag (/lib/x86_64-linux-gnu/libxml2.so.2+0x4b5a6)
#10 0x7f2b14fbcf27 (/lib/x86_64-linux-gnu/libxml2.so.2+0x4df27)
#11 0x7f2b14fc27cf in xmlParseContent (/lib/x86_64-linux-gnu/libxml2.so.2+0x537cf)
#12 0x7f2b14fc3f0f in xmlParseDocument (/lib/x86_64-linux-gnu/libxml2.so.2+0x54f0f)
#13 0x557c59ee59cf in GeneratedSaxParser::LibxmlSaxParser::parseFile(char const*) /home/nale/OpenCOLLADA-1.6.63/GeneratedSaxParser/src/GeneratedSaxParserLibxmlSaxParser.cpp:103
#14 0x557c58ad53ca in COLLADASaxFWL::VersionParser::createAndLaunchParser() /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLVersionParser.cpp:329
#15 0x557c58ad2a3e in COLLADASaxFWL::FileLoader::load() /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLFileLoader.cpp:79
#16 0x557c58a632be in COLLADASaxFWL::Loader::loadDocument(std::__cxx11::basic_string, std::allocator > const&, COLLADAFW::IWriter*) /home/nale/OpenCOLLADA-1.6.63/COLLADASaxFrameworkLoader/src/COLLADASaxFWLLoader.cpp:226
#17 0x557c58a536f4 in parse(char*, ValidationErrorHandler&) /home/nale/OpenCOLLADA-1.6.63/COLLADAValidator/src/main.cpp:37
#18 0x557c589fffbc in main /home/nale/OpenCOLLADA-1.6.63/COLLADAValidator/src/main.cpp:54
#19 0x7f2b14a570b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
#20 0x557c58a528ad in _start (/home/nale/OpenCOLLADA-1.6.63/build/bin/OpenCOLLADAValidator+0x75a8ad)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libstdc++.so.6+0x142d3b) in std::__cxx11::basic_string, std::allocator >::_M_assign(std::__cxx11::basic_string, std::allocator > const&)
==2010438==ABORTING
```

GDB info:

![image](https://user-images.githubusercontent.com/52778977/111883754-522ed000-89ce-11eb-9519-c6cd74de7597.png)

![image](https://user-images.githubusercontent.com/52778977/111883745-42af8700-89ce-11eb-965a-8e4c914e5021.png)

Environment:
Host Operating System and version: Ubuntu 20.04.2 LTS
Host CPU architecture: x86_64

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with COLLADABaseUtils/src/COLLADABUURI.cpp at line 225 and trace the call from COLLADASaxFWLMeshLoader.cpp:754. Reproduce the crash with OpenCOLLADAValidator and PoC.dae under AddressSanitizer, then verify that the crafted input no longer causes a segmentation fault.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
computer-graphics
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.