| 标题 | Assimp commit 17c12da Heap-based Buffer Overflow |
|---|
| 描述 | A heap-buffer-overflow vulnerability exists in Assimp's X File parser within the Assimp::Compression::decompressBlock() function at Compression.cpp:188, which triggers an invalid memory read operation in zlib's inflate logic at inflate.c:1077. The flaw occurs due to insufficient validation of malformed compressed data during file decompression. The XFileImporter allocates a fixed-size heap buffer based on the target file size, and directly passes the entire unvalidated buffer to the zlib decompression routine. Malformed crafted X file data can falsely indicate additional available input bytes beyond the bounds of the allocated buffer. The zlib inflate function continues to read memory past the end of the valid heap buffer, resulting in out-of-bounds memory access. This vulnerability can cause application crash and memory corruption; remote attackers can exploit this flaw via a maliciously crafted X file to trigger a denial-of-service (DoS) condition. |
|---|
| 来源 | ⚠️ https://github.com/assimp/assimp/issues/6624 |
|---|
| 用户 | TYGLS (UID 94774) |
|---|
| 提交 | 2026-06-29 14時42分 (3 月前) |
|---|
| 管理 | 2026-08-16 09時50分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 391144 [Open Asset Import Library Assimp 17c12da File Parser Compression.cpp decompressBlock 内存损坏] |
|---|
| 积分 | 20 |
|---|