Bug: MD2 importer heap-buffer-overflow
- Dominant language
- C++
- Stars
- 13.2k
- Forks
- 3.2k
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 21
Description
**Describe the bug**
My name is Ravshan. I'd like to describe the bug/vulnerability: Heap Overflow Memory-safety vulnerability.
A heap-buffer-overflow occurs in Assimp’s MD2 importer when processing a malformed input file.
The crash happens due to an out-of-bounds read in strlen(), called from Assimp::MD2Importer::InternReadFile().
strlen scans memory until it finds '\0'. If pcSkins->name points to bytes that do not contain a '\0' within the allocated region, strlen reads out-of-bounds.
Code:
[`poc.zip`](https://github.com/user-attachments/files/30972502/poc.zip)
**To Reproduce**
Steps to reproduce the behavior:
1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error
**Expected behavior**
A clear and concise description of what you expected to happen.
**Screenshots**
If applicable, add screenshots to help explain your problem.
**Platform (please complete the following information):**
- OS: [e.g. iOS]
- Browser [e.g. chrome, safari]
- Version [e.g. 22]
**Additional context**
Add any other context about the problem here.
Contributor guide
Research direction
Locate Assimp::MD2Importer::InternReadFile() and reproduce the crash with the attached poc.zip. Inspect how pcSkins->name is handled before strlen(), then verify malformed MD2 input no longer causes an out-of-bounds read and add regression coverage for the reproducer.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- computer-graphics, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100