提交 #955038: assimp >= v4.0.0 Out-of-Bounds Read

Open Asset Import Library (assimp) is a portable library for importing various 3D model formats.
This code is vulnerable to CWE‑125: Out‑of‑bounds Read due to improper handling of the internal cache buffer in IOStreamBuffer. The getNextBlock() function returns data from the physical end (m_cache.end()) instead of the logical end (m_cache.begin() + m_cacheSize). When the PLY loader opens a file smaller than its 1 MiB pre‑filled cache, this returns stale filler bytes beyond the actual content. An attacker can supply a binary PLY file whose header declares more faces than the body provides; the parser interprets filler bytes as valid indices (e.g., 0x0A as count 10, 0x0A0A0A0A as vertex index 168430090) and stores them without bounds checks. With aiProcess_Triangulate, this leads to a segmentation fault; without it, the library returns a corrupted scene, potentially crashing downstream consumers. Sanitizers detect the issue; release builds may experience memory corruption and denial of service.
More details: reported to assimp maintainers on 2026‑08‑16 (pending public disclosure). For additional information, including the exact affected version range, it can be provided via email.

• 用户: cz_seuer (UID 100791)
• 提交: 2026-09-01 11時15分 (1 月前)
• 管理: 2026-10-10 17時28分 (1 month later)
• 状态: 已接受
• VulDB条目: 416230 [Open Asset Import Library Assimp 直到 6.0.5 PLY File getNextBlock 信息公开]
• 积分: 17