assimp / assimp/assimp

Bug: MD2 importer heap-buffer-overflow

Open
#6,771 0 comments 0 reactions 0 assignees View on GitHub
Bug MD2
Dominant language
C++
Stars
13.2k
Forks
3.2k
Avg merge
2d 8h
Merged PRs (30d)
21

Description

**Describe the bug**
My name is Ravshan. I'd like to describe the bug/vulnerability: Heap Overflow Memory-safety vulnerability.
A heap-buffer-overflow occurs in Assimp’s MD2 importer when processing a malformed input file.
The crash happens due to an out-of-bounds read in strlen(), called from Assimp::MD2Importer::InternReadFile().

strlen scans memory until it finds '\0'. If pcSkins->name points to bytes that do not contain a '\0' within the allocated region, strlen reads out-of-bounds.
Code:

[`poc.zip`](https://github.com/user-attachments/files/30972502/poc.zip)

**To Reproduce**
Steps to reproduce the behavior:
1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

**Expected behavior**
A clear and concise description of what you expected to happen.

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Platform (please complete the following information):**
- OS: [e.g. iOS]
- Browser [e.g. chrome, safari]
- Version [e.g. 22]

**Additional context**
Add any other context about the problem here.

Contributor guide

Open the contributing guide

Research direction

Locate Assimp::MD2Importer::InternReadFile() and reproduce the crash with the attached poc.zip. Inspect how pcSkins->name is handled before strlen(), then verify malformed MD2 input no longer causes an out-of-bounds read and add regression coverage for the reproducer.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
computer-graphics, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.