| शीर्षक | Open Asset Import Library Assimp 5.4.3 Use After Free |
|---|
| विवरण | The program experiences a heap-use-after-free error when accessing a `std::vector` in the `Assimp::BVHLoader::ReadNodeChannels` function in `assimp/code/AssetLib/BVH/BVHLoader.cpp:303` . The error occurs after the memory for an object (specifically the `pNode` or its member `mChannels`) has been freed, but the program attempts to push a new element into the vector, causing undefined behavior and a crash.
```C++
void BVHLoader::ReadNodeChannels(BVHLoader::Node &pNode) {
// number of channels. Use the float reader because we're lazy
float numChannelsFloat = GetNextTokenAsFloat();
unsigned int numChannels = (unsigned int)numChannelsFloat;
for (unsigned int a = 0; a < numChannels; a++) {
std::string channelToken = GetNextToken();
...
else if (channelToken == "Zrotation")
pNode.mChannels.push_back(Channel_RotationZ);
else
ThrowException("Invalid channel specifier \"", channelToken, "\".");
}
}
```
This function attempts to push new values into the mChannels vector of pNode. The error occurs if pNode or its member mChannels has already been freed earlier in the program.
The following function appears to allocate memory for child nodes (`Assimp::BVHLoader::ReadNode()` in `assimp/code/AssetLib/BVH/BVHLoader.cpp`):
```C++
aiNode *child = ReadEndSite(nodeName);
child->mParent = node;
childNodes.push_back(child);
```
If a node or any of its components are freed prematurely (perhaps when deleting `node->mChildren`), any subsequent access to them could cause the heap-use-after-free error observed.
|
|---|
| स्रोत | ⚠️ https://github.com/assimp/assimp/issues/6219 |
|---|
| उपयोगकर्ता | Rulkallos (UID 86201) |
|---|
| सबमिशन | 06/06/2025 08:23 AM (1 वर्ष पहले) |
|---|
| संयम | 15/06/2025 12:18 PM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 312588 [Open Asset Import Library Assimp तक 5.4.3 BVHLoader.cpp ReadNodeChannels pNode बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|