Commit Graph

25 Commits

Author SHA1 Message Date
Kim Kulling
f544f9c217 Bugfix/fix sonarcube findings (#6369)
* Fix sonarcube findings.
---------
Co-authored-by: Kim Kulling <kim.kulling@draeger.com>
2025-10-14 00:01:50 +02:00
sSsA01
8355e0c4bc Fix to fail in the function fast_atoreal_move when the flag ASSIMP_DOUBLE_PRESICION is enabled (#6250)
* Refix export fbx PolygonVertexIndex

* Fix the function ColladaParser::ReadEffectColor when the flag ASSIMP_DOUBLE_PRESICION is enabled

* Fix the static function ReadLight in ColladaParser when the flag ASSIMP_DOUBLE_PRESICION is enabled

* Refactor of the call of the function fast_atoreal_move to the member of aiColor3D

* Fix the call of the function fast_atoreal_move when the flag ASSIMP_DOUBLE_PRESICION is enabled and and refactor

* Fix the call of the function fast_atoreal_move when the flag ASSIMP_DOUBLE_PRESICION is enabled

---------

Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
2025-07-29 14:19:50 +02:00
Vinz Spring
269987085f Fixes CVE-2025-2750: out of bounds write by assigning to wrong array element count tracking (closes #6011) (#6225)
description:
- The current implementation has faulty reallocation logic when parsing a CSM file
- Issue 1
    - 4ad1d2aa30/code/AssetLib/CSM/CSMLoader.cpp (L205)
    - By assigning s->mNumPositionKeys = alloc*2 right before resizing the buffer, making s->mNumPositionKeys equivalent to the
      max number of aiVectorKey that can be stored in s->mPositionKeys
    - the code later attempts to get the next write location by doing: aiVectorKey* sub = s->mPositionKeys + s->mNumPositionKeys;
    - this points to the end of the array, not after the last element in the array
- Issue 2
    - 4ad1d2aa30/code/AssetLib/CSM/CSMLoader.cpp (L178-L184)
    - if the CSM file does not declare last frame data, then mPositionKeys will never be initialized

fix:
- we preserve s->mNumPositionKeys to still contain the actual number of aiVectorKeys and ensure that we will not write out of bounds
- we initialize mPositionKeys with a default value and if we find last frame info, we just re-initialize it

Co-authored-by: Vinz Spring <vinzs@amazon.de>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
2025-06-08 13:46:39 +02:00
Vinz Spring
177797c77b Fixes CVE-2025-2751: Out-of-bounds Read in Assimp::CSMImporter::InternReadFile (closes #6012) (#6224)
description:
issue:
- 4ad1d2aa30/code/AssetLib/CSM/CSMLoader.cpp (L274C1-L275C1)
- sometimes the code tried to construct a new 4x4 matrix from a nullptr, thus reading out of bounds

fix:
- added nullptr check
- added array count check
- added default fallback init to identity matrix

Co-authored-by: Vinz Spring <vinzs@amazon.de>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
2025-06-08 12:10:12 +02:00
Kim Kulling
327afe0183 Fix crashes (#6138) 2025-05-07 23:40:53 +02:00
Kim Kulling
0c02313893 Refactor (#6127)
* Refactor 3DS

---------

Co-authored-by: Kim Kulling <kim.kulling@draeger.com>
2025-05-03 11:46:10 +02:00
Kim Kulling
2690e354da CMS: Fix possible overflow access (#6052)
- closes https://github.com/assimp/assimp/issues/6010
2025-03-13 21:10:49 +01:00
Kim Kulling
45898eee55 Refactorings: glTF cleanups (#6028) 2025-03-05 21:37:47 +01:00
Kim Kulling
5fa7b8ceb9 Bugfix/cosmetic code cleanup (#5947)
* Refactorings: Code cleanups

* More cosmetic changes

---------

Co-authored-by: Kim Kulling <kim.kulling@draeger.com>
2025-01-07 23:32:50 +01:00
Kim Kulling
01231d0e60 Add 2024 to copyright infos (#5475) 2024-02-23 22:30:05 +01:00
Kim Kulling
c08e3b4abb Add bounds checks to the parsing utilities. (#5421)
* Add bounds checks to the parsing utilities.

* Fix merge conflicts in ACLoader.

* Fix loaders

* Fix unittest of AC-Loader.

* Remove dead code.

* Md5Parser fixes

* Fix md5-parsing

* Fix Merge conflict

* Fix merge conflicts.

* Md5: Fix warning: missing return statement.
2024-01-30 14:32:41 +01:00
Kim Kulling
8cf2d6e588 Refactoring: Some cleanups 2023-11-12 21:09:33 +01:00
Aaron Gokaslan
ccfb175460 Apply various clang-tidy checks for smartprs and modern C++ types 2022-11-08 11:03:55 -05:00
Aaron Gokaslan
6fa21dcc6e Explicitly default all empty dtors 2022-08-25 11:32:59 -04:00
Kim Kulling
05746acb07 Merge branch 'new-file-detection' of https://github.com/krishty/assimp into krishty-new-file-detection 2022-01-16 20:41:24 +01:00
Kim Kulling
50c7301a38 Update copyrights 2022-01-10 21:13:43 +01:00
krishty
8c84afaff0 Merge branch 'master' into const-tokens 2021-09-15 23:31:00 +02:00
Kim Kulling
18531e3677 Next iteration for c++11 features. 2021-09-13 22:38:20 +02:00
Krishty
5895c0c22c more const in format detection
BaseImporter::SearchFileHeaderForToken() expected a pointer to a non-const token list. This was probably an oversight, as nobody would realistically expect the function to change the list. Furthermore, it prevented token lists from being compiled to read-only memory, in some cases even causing the compiler to generate thread-safe initialization.

The list is now const and all callers declare their token lists static const, thus compiling them to read-only memory.
2021-09-11 23:23:05 +02:00
Krishty
0f3e6e2941 replaced std::size() with AI_COUNT_OF for pre-C++20 compilers 2021-05-05 00:08:54 +02:00
Krishty
b00de10eb3 Simplified importer search and fixed a few bugs
The search for a matching importer had a few issues, see #3791. There were two different mechanisms to determine whether an importer accepts a specific file extension:
1. `aiImporterDesc::mFileExtensions`, which was forwarded to the UI via `BaseImporter::GetExtensionList()`.
2. `BaseImporter::CanRead()` when called with `checkSig == false`, which determines whether to actually use that importer.
Both were redundant and got out of sync repeatedly. I removed 2. completely and replaced it with 1., thereby syncing UI/import and shortening all `BaseImporter::CanRead()` implementations.

Further bugfixes:
- fixed glTF2 importer throwing exceptions when checking whether it can load a file
- removed `BaseImporter::SimpleExtensionCheck()` because it is no longer used and had a bug with case sensitivity

Since the `checkSig` parameter in `BaseImporter::CanRead()` is now useless, it can be removed completely. I’m not sure if this would break ABI compatiblity, so I’ll submit it with a later pull request.
2021-04-24 00:17:50 +02:00
Kim Kulling
9e8dbd0ca5 Update copyrights to 2021. 2021-02-28 12:17:54 +01:00
Malcolm Tyrrell
b7c789da67 Stop concatenating std::strings. Use formatter. 2020-08-18 17:35:08 +01:00
Kim Kulling
6205af4efb replace NULL and avoid ai_assert with more than 2 tests. 2020-06-23 21:05:42 +02:00
Kim Kulling
f8e6512a63 Move format importer and exporter into its won folder. 2020-05-02 15:14:38 +02:00