assimp / assimp/assimp

Bug : invalid test file(SEGV)::emptySequenceGroupNames

Open
#4,307 4 comments 0 reactions 0 assignees View on GitHub
Bug Fuzzer
Dominant language
C++
Stars
13.2k
Forks
3.2k
Avg merge
2d 8h
Merged PRs (30d)
21

Description

Describe the bug
A bug was found within the assimp. Though it might not be an intended use of the relevant API, the bug can still produce critical issues within a program using assimp. It would be best if the affected logic is checked beforehand.
The bug was found with a fuzzer based on the function "utMDLImporter_HL1_Nodes.emptySequenceGroupNames"
This may cause problems in the use of libraries
When you read this test file
SEGV error is triggered during the Running InternReadFile function
I think this code is needed to be exceptional processing for the unintended number.

```
==29189==ERROR: AddressSanitizer: SEGV on unknown address 0x62400d1cc3fd (pc 0x00000127e0cc bp 0x7ffe75507010 sp 0x7ffe75506d40 T0)
==29189==The signal is caused by a READ memory access.
#0 0x127e0cb in Assimp::MDL::HalfLife::HL1MDLLoader::read_texture(Assimp::MDL::HalfLife::Texture_HL1 const*, unsigned char*, unsigned char*, aiTexture*, aiColor3D&) assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp:377:28
#1 0x125cf72 in Assimp::MDL::HalfLife::HL1MDLLoader::read_textures() assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp:395:9
#2 0x1257210 in Assimp::MDL::HalfLife::HL1MDLLoader::load_file() /ssd_array/utopia_paper/fuzz-test-generation/tmp/report_source/segv/Group14/assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp:162:9
#3 0x1256bdd in Assimp::MDL::HalfLife::HL1MDLLoader::HL1MDLLoader(aiScene*, Assimp::IOSystem*, unsigned char const*, std::__cxx11::basic_string, std::allocator > const&, Assimp::MDL::HalfLife::HL1ImportSettings const&) assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp:101:5
#4 0x121facb in Assimp::MDLImporter::InternReadFile_HL1(std::__cxx11::basic_string, std::allocator > const&, unsigned int) assimp/code/AssetLib/MDL/MDLLoader.cpp:1966:28
#5 0x1210fdb in Assimp::MDLImporter::InternReadFile(std::__cxx11::basic_string, std::allocator > const&, aiScene*, Assimp::IOSystem*) assimp/code/AssetLib/MDL/MDLLoader.cpp:249:17
#6 0xb280fa in Assimp::BaseImporter::ReadFile(Assimp::Importer*, std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem*) assimp/code/Common/BaseImporter.cpp:112:9
#7 0xb65bd0 in Assimp::Importer::ReadFile(char const*, unsigned int) assimp/code/Common/Importer.cpp:675:30

```

How To Reproduce
Download the attached file
Execute reproduce.sh
assimp/build/bin/unit --gtest_filter="utMDLImporter_HL1_Nodes.emptySequenceGroupNames"

Expected behavior
This can always cause problems when reading an invalid test file. Exception handling is required for reading an invalid test file.

Platform (please complete the following information):
OS: Ubuntu 18.04
[assimp_bug12.tar.gz](https://github.com/assimp/assimp/files/7782138/assimp_bug12.tar.gz)

Contributor guide

Open the contributing guide

Research direction

Start with code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp, especially read_texture() at line 377 and the load path shown in the stack trace. Run reproduce.sh and assimp/build/bin/unit --gtest_filter="utMDLImporter_HL1_Nodes.emptySequenceGroupNames" using the attached archive. Done means the malformed test file no longer triggers a SEGV while reading.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
computer-graphics
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.