| 제목 | assimp >= v4.0.0 Out-of-Bounds Read |
|---|
| 설명 | Open Asset Import Library (assimp) is a portable library for importing various 3D model formats.
This code is vulnerable to CWE‑125: Out‑of‑bounds Read due to improper handling of the internal cache buffer in IOStreamBuffer. The getNextBlock() function returns data from the physical end (m_cache.end()) instead of the logical end (m_cache.begin() + m_cacheSize). When the PLY loader opens a file smaller than its 1 MiB pre‑filled cache, this returns stale filler bytes beyond the actual content. An attacker can supply a binary PLY file whose header declares more faces than the body provides; the parser interprets filler bytes as valid indices (e.g., 0x0A as count 10, 0x0A0A0A0A as vertex index 168430090) and stores them without bounds checks. With aiProcess_Triangulate, this leads to a segmentation fault; without it, the library returns a corrupted scene, potentially crashing downstream consumers. Sanitizers detect the issue; release builds may experience memory corruption and denial of service.
More details: reported to assimp maintainers on 2026‑08‑16 (pending public disclosure). For additional information, including the exact affected version range, it can be provided via email. |
|---|
| 사용자 | cz_seuer (UID 100791) |
|---|
| 제출 | 2026. 09. 01. AM 11:15 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 10. PM 05:28 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416230 [Open Asset Import Library Assimp 까지 6.0.5 PLY File getNextBlock 정보 공개] |
|---|
| 포인트들 | 17 |
|---|