google / google/filament

gltfio: Heap out-of-bounds read in resource loaders and TangentsJob under release builds

Open
#10,134 0 comments 0 reactions 1 assignee Claimed by @poweifeng View on GitHub
gltf security
Dominant language
C++
Stars
20.5k
Forks
2.3k
Avg merge
2d 14h
Merged PRs (30d)
83

Description

**Describe the bug**
Under release builds (`NDEBUG` defined), the glTF validator wrapper `cgltf_validate` in `libs/gltfio/src/Utility.cpp` is compiled out. This allows a malformed glTF model with invalid accessor ranges/counts (which exceed the actual buffer size) to bypass validation and trigger a heap out-of-bounds read during attribute unpacking (e.g., inside `TangentsJob::run` or other resource loaders). Additionally, `ResourceLoader::loadResources` ignores the return value of `loadCgltfBuffers`, letting loading continue even if loading/validation fails.

**To Reproduce**
Steps to reproduce the behavior:
1. Build Filament's test targets in a Release configuration (`-DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_CXX_FLAGS='-fsanitize=address -DNDEBUG'`).
2. Generate a glTF file with an accessor element count that demands more bytes than the backing buffer contains (e.g., accessor count `10000` pointing to a `100` byte buffer).
3. Load the malformed asset using the Filament `ResourceLoader` and run the tangents generator or resource unpacker.
4. The process will crash with a heap-buffer-overflow trace under AddressSanitizer.

**Expected behavior**
The glTF loader should always validate the model's structural constraints (via `cgltf_validate`) regardless of build configuration (including release builds) and reject the malformed asset cleanly before attempting to copy or unpack attributes.

**Screenshots**
N/A

**Logs**
```
==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50b000012584 at pc 0x558e4cce6766 bp 0x7ffc492ed7e0 sp 0x7ffc492ecfa0
READ of size 120000 at 0x50b000012584 thread T0
#0 0x558e4cce6765 in __asan_memcpy
#1 0x558e4ce91193 in cgltf_accessor_unpack_floats /workspace/targets/filament/third_party/cgltf/tnt/../cgltf.h:2403:4
#2 0x558e4ce760db in filament::gltfio::TangentsJob::run(filament::gltfio::TangentsJob::Params*) /workspace/targets/filament/libs/gltfio/src/TangentsJob.cpp:118:9
```

**Desktop (please complete the following information):**
- OS: Linux (Ubuntu 24.04 inside Docker container)
- GPU: N/A
- Backend: Noop

**Smartphone (please complete the following information):**
- Device: N/A
- OS: N/A

**Additional context**
The root cause is the `#ifndef NDEBUG` check surrounding `cgltf_validate` in `libs/gltfio/src/Utility.cpp` and the unhandled return value of `utility::loadCgltfBuffers` in `libs/gltfio/src/ResourceLoader.cpp`. Removing the debug guard and validating the return value resolves the crash.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.