From 177797c77b027a6de080fb3bacbd8822617e11d8 Mon Sep 17 00:00:00 2001 From: Vinz Spring Date: Sun, 8 Jun 2025 12:10:12 +0200 Subject: [PATCH] Fixes CVE-2025-2751: Out-of-bounds Read in Assimp::CSMImporter::InternReadFile (closes #6012) (#6224) description: issue: - https://github.com/assimp/assimp/blob/4ad1d2aa3086517816716a50aa122342806736f9/code/AssetLib/CSM/CSMLoader.cpp#L274C1-L275C1 - sometimes the code tried to construct a new 4x4 matrix from a nullptr, thus reading out of bounds fix: - added nullptr check - added array count check - added default fallback init to identity matrix Co-authored-by: Vinz Spring Co-authored-by: Kim Kulling --- code/AssetLib/CSM/CSMLoader.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/code/AssetLib/CSM/CSMLoader.cpp b/code/AssetLib/CSM/CSMLoader.cpp index 6ea3f8ef9..497dc0aeb 100644 --- a/code/AssetLib/CSM/CSMLoader.cpp +++ b/code/AssetLib/CSM/CSMLoader.cpp @@ -271,7 +271,13 @@ void CSMImporter::InternReadFile( const std::string& pFile, nd->mName = anim->mChannels[i]->mNodeName; nd->mParent = pScene->mRootNode; - aiMatrix4x4::Translation(na->mPositionKeys[0].mValue, nd->mTransformation); + if (na->mPositionKeys != nullptr && na->mNumPositionKeys > 0) { + aiMatrix4x4::Translation(na->mPositionKeys[0].mValue, nd->mTransformation); + } else { + // Use identity matrix if no valid position data is available + nd->mTransformation = aiMatrix4x4(); + DefaultLogger::get()->warn("CSM: No position keys available for node - using identity transformation"); + } } // Store the one and only animation in the scene