[BUG] An out-of-memory in `draco::DataBuffer::Update(void const*, long, long)` at `src/draco/core/data_buffer.cc:34:11`
- Dominant language
- C++
- Stars
- 7.5k
- Forks
- 1.1k
- Avg merge
- 47m
- Merged PRs (30d)
- 1
Description
## Description
- Version: Latest commit [4e12ab2](https://github.com/google/draco/commit/4e12ab27d0fe690cf98e96dc33c2bd52e1485163)
- Environment:Ubuntu 20.04.6 LTS, Clang 18.1.8
## Steps to reproduce
```bash
export CC="clang"
export CXX="clang++"
export CFLAGS="-fsanitize=address -g -O0 -fno-omit-frame-pointer"
export CXXFLAGS="-fsanitize=address -g -O0 -fno-omit-frame-pointer -stdlib=libc++"
export LIB_FUZZING_ENGINE="-fsanitize=fuzzer"
export SRC=$PWD
export WORK=$SRC/build
mkdir -p $WORK
git clone https://github.com/google/draco
cd draco && git checkout 4e12ab2
cd $WORK
cmake ../draco
make -j$(nproc)
for fuzzer in $(find $SRC/draco/src/draco/tools/fuzz -name '*.cc'); do
fuzzer_basename=$(basename -s .cc $fuzzer)
$CXX $CXXFLAGS \
-I $SRC/ \
-I $SRC/draco/src \
-I $WORK/ \
$LIB_FUZZING_ENGINE \
$fuzzer \
$WORK/libdraco.a \
-o $WORK/$fuzzer_basename
done
wget https://github.com/user-attachments/files/19589832/draco_crash_1.txt -O draco_crash_1.in
$WORK/draco_pc_decoder_fuzzer draco_crash_1.in
```
## Sanitizer output
```
root@1520c6344bf0:/src# ./build/draco_pc_decoder_fuzzer draco_crash_1.in
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 1415050739
INFO: Loaded 1 modules (117 inline 8-bit counters): 117 [0x616818a401e0, 0x616818a40255),
INFO: Loaded 1 PC tables (117 PCs): 117 [0x616818a40258,0x616818a409a8),
./build/draco_pc_decoder_fuzzer: Running 1 inputs 1 time(s) each.
Running: draco_crash_1.in
=================================================================
==129938==ERROR: AddressSanitizer: out of memory: allocator is trying to allocate 0x4ee0ffffd0 bytes
#0 0x6168187d42dd in operator new(unsigned long) /src/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:86:3
#1 0x61681887eda9 in void* std::__1::__libcpp_operator_new[abi:ne180100](unsigned long) /usr/local/bin/../include/c++/v1/new:271:10
#2 0x61681887eda9 in std::__1::__libcpp_allocate[abi:ne180100](unsigned long, unsigned long) /usr/local/bin/../include/c++/v1/new:295:10
#3 0x61681887eda9 in std::__1::allocator::allocate[abi:ne180100](unsigned long) /usr/local/bin/../include/c++/v1/__memory/allocator.h:125:32
#4 0x61681887eda9 in std::__1::__allocation_result>::pointer> std::__1::__allocate_at_least[abi:ne180100]>(std::__1::allocator&, unsigned long) /usr/local/bin/../include/c++/v1/__memory/allocate_at_least.h:55:19
#5 0x61681887eda9 in std::__1::__split_buffer&>::__split_buffer(unsigned long, unsigned long, std::__1::allocator&) /usr/local/bin/../include/c++/v1/__split_buffer:343:25
#6 0x61681887eda9 in std::__1::vector>::__append(unsigned long) /usr/local/bin/../include/c++/v1/vector:1095:49
#7 0x6168188fe0aa in std::__1::vector>::resize(unsigned long) /usr/local/bin/../include/c++/v1/vector:1750:11
#8 0x6168188fe0aa in draco::DataBuffer::Update(void const*, long, long) /src/draco/src/draco/core/data_buffer.cc:34:11
#9 0x616818844719 in draco::PointAttribute::Reset(unsigned long) /src/draco/src/draco/attributes/point_attribute.cc:71:27
#10 0x616818876f86 in draco::KdTreeAttributesDecoder::DecodeDataNeededByPortableTransforms(draco::DecoderBuffer*) /src/draco/src/draco/compression/attributes/kd_tree_attributes_decoder.cc:398:13
#11 0x61681887e10d in draco::AttributesDecoder::DecodeAttributes(draco::DecoderBuffer*) /src/draco/src/draco/compression/attributes/attributes_decoder.h:59:10
#12 0x61681882aa8f in draco::PointCloudDecoder::DecodeAllAttributes() /src/draco/src/draco/compression/point_cloud/point_cloud_decoder.cc:181:19
#13 0x61681882a868 in draco::PointCloudDecoder::DecodePointAttributes() /src/draco/src/draco/compression/point_cloud/point_cloud_decoder.cc:169:8
#14 0x616818829dcc in draco::PointCloudDecoder::Decode(draco::DracoOptions const&, draco::DecoderBuffer*, draco::PointCloud*) /src/draco/src/draco/compression/point_cloud/point_cloud_decoder.cc:122:8
#15 0x6168187dac68 in draco::Decoder::DecodeBufferToGeometry(draco::DecoderBuffer*, draco::PointCloud*) /src/draco/src/draco/compression/decode.cc:105:3
#16 0x6168187da231 in draco::Decoder::DecodePointCloudFromBuffer(draco::DecoderBuffer*) /src/draco/src/draco/compression/decode.cc:73:5
#17 0x6168187d67a2 in LLVMFuzzerTestOneInput /src/draco/src/draco/tools/fuzz/draco_pc_decoder_fuzzer.cc:26:11
#18 0x61681868b140 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:614:13
#19 0x6168186763b5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:327:6
#20 0x61681867be4f in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:862:9
#21 0x6168186a70f2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
#22 0x7cd34194f082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 0323ab4806bee6f846d9ad4bccfc29afdca49a58)
==129938==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: out-of-memory /src/draco/src/draco/core/data_buffer.cc:34:11 in draco::DataBuffer::Update(void const*, long, long)
==129938==ABORTING
```
## POC
[draco_crash_1.txt](https://github.com/user-attachments/files/19589832/draco_crash_1.txt)
## Credit
Reported by Yifan Zhang, [PLL](https://pl.cs.pku.edu.cn/en/)
Contributor guide
Assessment
This issue has not been assessed yet.