gltfio: Heap out-of-bounds read in resource loaders and TangentsJob under release builds
- Dominant language
- C++
- Stars
- 20.5k
- Forks
- 2.3k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 83
Description
**Describe the bug**
Under release builds (`NDEBUG` defined), the glTF validator wrapper `cgltf_validate` in `libs/gltfio/src/Utility.cpp` is compiled out. This allows a malformed glTF model with invalid accessor ranges/counts (which exceed the actual buffer size) to bypass validation and trigger a heap out-of-bounds read during attribute unpacking (e.g., inside `TangentsJob::run` or other resource loaders). Additionally, `ResourceLoader::loadResources` ignores the return value of `loadCgltfBuffers`, letting loading continue even if loading/validation fails.
**To Reproduce**
Steps to reproduce the behavior:
1. Build Filament's test targets in a Release configuration (`-DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_CXX_FLAGS='-fsanitize=address -DNDEBUG'`).
2. Generate a glTF file with an accessor element count that demands more bytes than the backing buffer contains (e.g., accessor count `10000` pointing to a `100` byte buffer).
3. Load the malformed asset using the Filament `ResourceLoader` and run the tangents generator or resource unpacker.
4. The process will crash with a heap-buffer-overflow trace under AddressSanitizer.
**Expected behavior**
The glTF loader should always validate the model's structural constraints (via `cgltf_validate`) regardless of build configuration (including release builds) and reject the malformed asset cleanly before attempting to copy or unpack attributes.
**Screenshots**
N/A
**Logs**
```
==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50b000012584 at pc 0x558e4cce6766 bp 0x7ffc492ed7e0 sp 0x7ffc492ecfa0
READ of size 120000 at 0x50b000012584 thread T0
#0 0x558e4cce6765 in __asan_memcpy
#1 0x558e4ce91193 in cgltf_accessor_unpack_floats /workspace/targets/filament/third_party/cgltf/tnt/../cgltf.h:2403:4
#2 0x558e4ce760db in filament::gltfio::TangentsJob::run(filament::gltfio::TangentsJob::Params*) /workspace/targets/filament/libs/gltfio/src/TangentsJob.cpp:118:9
```
**Desktop (please complete the following information):**
- OS: Linux (Ubuntu 24.04 inside Docker container)
- GPU: N/A
- Backend: Noop
**Smartphone (please complete the following information):**
- Device: N/A
- OS: N/A
**Additional context**
The root cause is the `#ifndef NDEBUG` check surrounding `cgltf_validate` in `libs/gltfio/src/Utility.cpp` and the unhandled return value of `utility::loadCgltfBuffers` in `libs/gltfio/src/ResourceLoader.cpp`. Removing the debug guard and validating the return value resolves the crash.
Contributor guide
Assessment
This issue has not been assessed yet.