The `GetVertexColorsForType` function previously used `input->count`
(the total number of elements in the accessor) to allocate the output
array and bound the conversion loop. However, when a
`vertexRemappingTable` is provided, `ExtractData` extracts a subset of
elements matching the size of the remapping table rather than the full
accessor count.
In cases where the remapping table was smaller than the accessor count
(including empty tables), the subsequent loop would perform
out-of-bounds reads on the `colors` buffer allocated by `ExtractData`.
This fix captures the actual number of elements extracted by
`ExtractData` and uses this value for the output allocation and loop
iteration, ensuring memory safety when vertex remapping is active.
Verified with ASan and existing unit tests.
fix(gltf2): preserve interpolation type and CubicSpline tangents
The glTF2 importer previously ignored the mInterpolation field and discarded
CubicSpline tangent data, leading to incorrect animation playback.
- Implement MapInterpolation() to map glTF2 interpolation types to Assimp.
- Set mInterpolation for all aiVectorKey and aiQuatKey instances.
- For CUBICSPLINE samplers, store [in-tangent, value, out-tangent] triplets
(N x 3 keys) instead of discarding tangents.
- Fixes rendering consistency for InterpolationTest.glb where STEP, LINEAR,
and CUBICSPLINE rows previously rendered identically.
Affected channels: mPositionKeys, mRotationKeys, mScalingKeys.
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* glTF2: Fix heap-buffer-overflow in Accessor validation and size calculation
This patch fixes a heap-buffer-overflow in
`glTF2::Accessor::ExtractData` caused by incorrect bounds validation and
available size reporting.
The vulnerability stemmed from two issues in `glTF2Asset.inl`:
1. **Underestimated validation in `Accessor::Read`**: The logic used
`GetBytesPerComponent() * count` to validate the required buffer
size. This failed to account for the actual `stride`, allowing
accessors to pass validation even if their total footprint
(including stride) exceeded the buffer view.
2. **Incorrect size reporting in `Accessor::GetMaxByteSize`**: The
function returned the total `bufferView->byteLength` while ignoring
the `byteOffset`. Since the accessor data starts at `byteOffset`,
the actual available space is `byteLength - byteOffset`. This led
`ExtractData` to permit reads that extended beyond the end of the
allocated buffer.
Changes:
* Modified `Accessor::Read` to use `GetStride() * count` for length
validation.
* Updated `Accessor::GetMaxByteSize` to correctly return
`bufferView->byteLength - byteOffset` for standard accessors and
`sparse->data.size()` for sparse accessors.
Co-authored-by: CodeMender <codemender-patching@google.com>
Fixes: https://issues.oss-fuzz.com/issues/483102963
* address comment
---------
Co-authored-by: CodeMender <codemender-patching@google.com>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* Update copyright year and project version
- Fixes version in lib
* Update copyright year to 2026
* Update copyright year to 2026 in Version.cpp
* Update copyright year and version patch test
* Fix copyright year
* Adapt copyrights
* Harmonize Importer #includes
Some importers referred to their headers via `#include "AssetLib/[format]/[header.h"`, others via `#include "[header].h"`, others mixed both (e.g. IRR). This is a matter of taste, but it should at least be done the same way everywhere.
Most importers seem to prefer `#include "[header].h"`, so this commit enforces it.
Cross-referencing files from other importers is still done through `AssetLib/[format]`.
Assimp headers are not affected and I would advise against changing them, as this could lead to subtle collisions with user includes.
* went one too far
---------
Co-authored-by: Krishty <krishty@krishty.com>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* Fix Whitespace
No functional changes. This commit removes trailing spaces, undesired line breaks, and formatting screwups.
* Remove more useless line breaks in license (500 out of 630 license copies do NOT use double line breaks here)
---------
Co-authored-by: Krishty <krishty@krishty.com>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
Previously tangents were not being exported. If they are present, they should also be properly
exported.
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* Fix: Fix name collision
* Fix: Fix possible override
* Fix: Use reentrant providing time function
* Fix: Fix override
* Update AssbinFileWriter.cpp
Revert, not portable.
* Update AssxmlFileWriter.cpp
Revert asctime_r, not portable.
Previously GLTF meshes were created even if there were no faces, which lead to GLTFs which were not technically valid.
I believe this fixes the problem I was encountering, but I've not been able to test it because of some Mac compile errors. Will test on a windows machine at some point.
Fixes#5868
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* Fix identity matrix check
Adds an extra epsilon value to check the matrix4x4 identity. The method is also used to export to GLTF/GLTF2 format to check node transformation matrices. The epsilon value can be set using AI_CONFIG_CHECK_IDENTITY_MATRIX_EPSILON with the default value set to 10e-3f for backward compatibility of legacy code.
* Fix type of float values in the unit test
* Update matrix4x4.inl
Fix typo
* Update matrix4x4.inl
Remove dead code.
* Add isIdentity-Test
* Update AssimpAPITest_aiMatrix4x4.cpp
---------
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
Previously was reading a uint, which always failed. Since the output was never checked, this
seemed to work, and works fine for most models since they only use UV channel 0.
Allows to export unlimited (more than 4) bones per vertex
Use JOINTS_1,2,.. and WEIGHTS_1,2,...
Added AI_CONFIG_EXPORT_GLTF_UNLIMITED_SKINNING_BONES_PER_VERTEX flag
