Bug: Memory Allocation Vulnerability in Blender Importers
- Dominant language
- C++
- Stars
- 13.2k
- Forks
- 3.2k
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 21
Description
**Describe the bug**
When using the assimp extract command to process Blender files, an AddressSanitizer error occurs due to an invalid memory allocation request (size 0xffffffffffffffff). The crash originates in Assimp::Blender::createMEdge() (BlenderCustomData.cpp:59), triggered during the parsing of custom Blender mesh data.
**To Reproduce**
Steps to compile:
```bash
git clone https://github.com/assimp/assimp.git
cd assimp
git checkout db0bde758e5043546cb2f45126c5693d2d9550f3
export CC=clang CXX=clang++ CFLAGS='-fsanitize=address -g -O0' CXXFLAGS='-fsanitize=address -g -O0'
cmake CMakeLists.txt -DASSIMP_BUILD_ASSIMP_TOOLS=ON -DASSIMP_ASAN=ON -DBUILD_SHARED_LIBS=OFF -DASSIMP_INJECT_DEBUG_POSTFIX=ON
-- The C compiler identification is Clang 16.0.6
-- The CXX compiler identification is Clang 16.0.6
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Check for working C compiler: /usr/bin/clang - skipped
-- Detecting C compile features
-- Detecting C compile features - done
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Check for working CXX compiler: /usr/bin/clang++ - skipped
-- Detecting CXX compile features
-- Detecting CXX compile features - done
-- Shared libraries disabled
-- AddressSanitizer enabled
-- Looking for ZLIB...
-- Found PkgConfig: /usr/bin/pkg-config (found version "0.29.2")
-- Checking for module 'zzip-zlib-config'
-- No package 'zzip-zlib-config' found
-- Found ZLIB: optimized;/usr/lib/x86_64-linux-gnu/libz.a;debug;/usr/lib/x86_64-linux-gnu/libz.a
-- Checking for module 'minizip'
-- No package 'minizip' found
-- VRML disabled
-- tinyusdz disabled
-- Enabled importer formats: AMF 3DS AC ASE ASSBIN B3D BVH COLLADA DXF CSM HMP IRRMESH IQM IRR LWO LWS MD2 MD3 MD5 MDC MDL NFF NDO OFF OBJ OGRE OPENGEX PLY MS3D COB BLEND IFC XGL FBX Q3D Q3BSP RAW SIB SMD STL TERRAGEN 3D X X3D GLTF 3MF MMD
-- Disabled importer formats: USD
-- Enabled exporter formats: OBJ OPENGEX PLY 3DS ASSBIN ASSXML COLLADA FBX STL X X3D GLTF 3MF PBRT ASSJSON STEP
-- Disabled exporter formats:
-- Treating all warnings as errors (for assimp library only)
Building Assimp Viewer only supported on Windows.
-- Configuring done
-- Generating done
-- Build files have been written to: /src/assimp
cmake --build . -j8
```
Steps to Reproduce:
```
cd bin
./assimp extract assimp_poc7 /dev/null
param = /dev/null
Launching asset import ... OK
Validating postprocessing flags ... OK
=================================================================
==1864074==ERROR: AddressSanitizer: requested allocation size 0xffffffffffffffff (0x800 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
#0 0x55555591668d in operator new[](unsigned long) (/src/assimp/bin/assimp+0x3c268d) (BuildId: 6f81bdaab5badac78cdfc0fa099d7d8269c10f3f)
#1 0x555556699a7d in Assimp::Blender::createMEdge(unsigned long) /src/assimp/code/AssetLib/Blender/BlenderCustomData.cpp:59:1
#2 0x55555669c48f in Assimp::Blender::readCustomData(std::shared_ptr&, int, unsigned long, Assimp::Blender::FileDatabase const&) /src/assimp/code/AssetLib/Blender/BlenderCustomData.cpp:159:19
#3 0x55555661e0a0 in bool Assimp::Blender::Structure::ReadCustomDataPtr<2>(std::shared_ptr&, int, char const*, Assimp::Blender::FileDatabase const&) const /src/assimp/code/AssetLib/Blender/BlenderDNA.inl:339:12
#4 0x5555565fb19e in void Assimp::Blender::Structure::Convert(Assimp::Blender::CustomDataLayer&, Assimp::Blender::FileDatabase const&) const /src/assimp/code/AssetLib/Blender/BlenderScene.cpp:842:5
#5 0x55555661ce1d in bool Assimp::Blender::Structure::ReadFieldPtrVector<1, std::shared_ptr, Assimp::Blender::CustomDataLayer>(Assimp::Blender::vector>&, char const*, Assimp::Blender::FileDatabase const&) const /src/assimp/code/AssetLib/Blender/BlenderDNA.inl:392:6
#6 0x5555565fafcc in void Assimp::Blender::Structure::Convert(Assimp::Blender::CustomData&, Assimp::Blender::FileDatabase const&) const /src/assimp/code/AssetLib/Blender/BlenderScene.cpp:823:5
#7 0x555556615023 in void Assimp::Blender::Structure::ReadField<1, Assimp::Blender::CustomData>(Assimp::Blender::CustomData&, char const*, Assimp::Blender::FileDatabase const&) const /src/assimp/code/AssetLib/Blender/BlenderDNA.inl:290:11
#8 0x5555565f90a2 in void Assimp::Blender::Structure::Convert(Assimp::Blender::Mesh&, Assimp::Blender::FileDatabase const&) const /src/assimp/code/AssetLib/Blender/BlenderScene.cpp:516:5
#9 0x555556620887 in void Assimp::Blender::Structure::Convert(std::shared_ptr, Assimp::Blender::FileDatabase const&) const /src/assimp/code/AssetLib/Blender/BlenderDNA.inl:94:5
#10 0x55555663a153 in bool Assimp::Blender::Structure::ResolvePointer(std::shared_ptr&, Assimp::Blender::Pointer const&, Assimp::Blender::FileDatabase const&, Assimp::Blender::Field const&, bool) const /src/assimp/code/AssetLib/Blender/BlenderDNA.inl:580:5
#11 0x5555566047a3 in bool Assimp::Blender::Structure::ReadFieldPtr<2, std::shared_ptr, Assimp::Blender::ElemBase>(std::shared_ptr&, char const*, Assimp::Blender::FileDatabase const&, bool) const /src/assimp/code/AssetLib/Blender/BlenderDNA.inl:209:22
#12 0x5555565f592b in void Assimp::Blender::Structure::Convert(Assimp::Blender::Object&, Assimp::Blender::FileDatabase const&) const /src/assimp/code/AssetLib/Blender/BlenderScene.cpp:78:5
#13 0x55555662c05c in bool Assimp::Blender::Structure::ResolvePointer(std::shared_ptr&, Assimp::Blender::Pointer const&, Assimp::Blender::FileDatabase const&, Assimp::Blender::Field const&, bool) const /src/assimp/code/AssetLib/Blender/BlenderDNA.inl:453:15
#14 0x5555566037e3 in bool Assimp::Blender::Structure::ReadFieldPtr<1, std::shared_ptr, Assimp::Blender::Object>(std::shared_ptr&, char const*, Assimp::Blender::FileDatabase const&, bool) const /src/assimp/code/AssetLib/Blender/BlenderDNA.inl:209:22
#15 0x5555565f7862 in void Assimp::Blender::Structure::Convert(Assimp::Blender::Base&, Assimp::Blender::FileDatabase const&) const /src/assimp/code/AssetLib/Blender/BlenderScene.cpp:315:9
#16 0x5555566492bc in bool Assimp::Blender::Structure::ResolvePointer(std::shared_ptr&, Assimp::Blender::Pointer const&, Assimp::Blender::FileDatabase const&, Assimp::Blender::Field const&, bool) const /src/assimp/code/AssetLib/Blender/BlenderDNA.inl:453:15
#17 0x55555660cf53 in bool Assimp::Blender::Structure::ReadFieldPtr<1, std::shared_ptr, Assimp::Blender::Base>(std::shared_ptr&, char const*, Assimp::Blender::FileDatabase const&, bool) const /src/assimp/code/AssetLib/Blender/BlenderDNA.inl:209:22
#18 0x5555565fa019 in void Assimp::Blender::Structure::Convert(Assimp::Blender::Scene&, Assimp::Blender::FileDatabase const&) const /src/assimp/code/AssetLib/Blender/BlenderScene.cpp:708:5
#19 0x555556586868 in Assimp::BlenderImporter::ExtractScene(Assimp::Blender::Scene&, Assimp::Blender::FileDatabase const&) /src/assimp/code/AssetLib/Blender/BlenderLoader.cpp:221:8
#20 0x555556585923 in Assimp::BlenderImporter::InternReadFile(std::__cxx11::basic_string, std::allocator> const&, aiScene*, Assimp::IOSystem*) /src/assimp/code/AssetLib/Blender/BlenderLoader.cpp:156:5
#21 0x555555ebd04b in Assimp::BaseImporter::ReadFile(Assimp::Importer*, std::__cxx11::basic_string, std::allocator> const&, Assimp::IOSystem*) /src/assimp/code/Common/BaseImporter.cpp:131:9
#22 0x555555968b5c in Assimp::Importer::ReadFile(char const*, unsigned int) /src/assimp/code/Common/Importer.cpp:709:30
#23 0x55555594a5a2 in Assimp::Importer::ReadFile(std::__cxx11::basic_string, std::allocator> const&, unsigned int) /src/assimp/include/assimp/Importer.hpp:672:12
#24 0x555555947352 in ImportModel(ImportData const&, std::__cxx11::basic_string, std::allocator> const&) /src/assimp/tools/assimp_cmd/Main.cpp:307:41
#25 0x555555944622 in Assimp_Extract(char const* const*, unsigned int) /src/assimp/tools/assimp_cmd/ImageExtractor.cpp:289:28
#26 0x555555946d71 in main /src/assimp/tools/assimp_cmd/Main.cpp:234:10
#27 0x7ffff7a6ed8f (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: d5197096f709801829b118af1b7cf6631efa2dcd)
==1864074==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: allocation-size-too-big (/src/assimp/bin/assimp+0x3c268d) (BuildId: 6f81bdaab5badac78cdfc0fa099d7d8269c10f3f) in operator new[](unsigned long)
==1864074==ABORTING
```
[assimp_poc7.zip](https://github.com/user-attachments/files/21216281/assimp_poc7.zip)
**Platform (please complete the following information):**
```
uname -v
#63~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 22 19:00:15 UTC 2
```
Contributor guide
Research direction
Start in code/AssetLib/Blender/BlenderCustomData.cpp at createMEdge() line 59 and follow its caller readCustomData() at line 159. Build with the shown CMake and AddressSanitizer settings, then run assimp extract on assimp_poc7.zip. Done means the sample no longer triggers an oversized allocation or crash during Blender import.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cmake, cpp
- Domain
- computer-graphics, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100