Obj: Fix heap-buffer-overflow in getFace via vertical tabs (#6540)

The `ObjFileParser::getFace` method failed to recognize the vertical tab
character (`\v`, 0x0b) as a separator. While the `IsSpaceOrNewLine`
utility handles most whitespace (space, tab, CR, LF, FF), it excludes
`\v`.

When encountering a vertical tab, the parser fell through to an `else`
block that calls `::atoi(&(*m_DataIt))`. Because `atoi` treats `\v` as
whitespace per the C standard, it skips the character and continues
reading. If `\v` is located at the end of the buffer (e.g., followed by
a newline at the buffer boundary), `atoi` can read past the allocated
memory, triggering a heap-buffer-overflow.

This fix explicitly checks for `\v` and treats it as a separator,
resetting the position counter and preventing the invalid `atoi` call.

Verified with AddressSanitizer and confirmed that all 584 existing unit
tests pass.

Fixes: https://issues.oss-fuzz.com/issues/476180586

Signed-off-by: Bill Wendling <morbo@google.com>
Co-authored-by: Meder Kydyraliev <meder@google.com>
Co-authored-by: CodeMender <codemender-patching@google.com>
This commit is contained in:
Bill Wendling
2026-02-21 10:19:02 -08:00
committed by GitHub
parent 970f8691dd
commit 21607dfb75

View File

@@ -467,7 +467,7 @@ void ObjFileParser::getFace(aiPrimitiveType type) {
ASSIMP_LOG_ERROR("Obj: Separator unexpected in point statement");
}
iPos++;
} else if (IsSpaceOrNewLine(*m_DataIt)) {
} else if (IsSpaceOrNewLine(*m_DataIt) || *m_DataIt == '\v') {
iPos = 0;
} else {
//OBJ USES 1 Base ARRAYS!!!!