The FBX exporter was unconditionally dereferencing a map iterator (`tp_elem`)
even when the key was not found (i.e., `tp_elem == tpath_by_image.end()`).
This resulted in a stack-use-after-scope error when accessing `tp_elem->second`
to populate "FileName" and "RelativeFilename" nodes, as dereferencing the
end iterator of the map accessed invalid stack memory (the map's sentinel).
The code already correctly initialized a local `tfile_path` variable based
on whether the iterator was valid. This patch updates the `AddChild` calls
to use `tfile_path` instead of dereferencing the potentially invalid iterator.
Fixes: https://issues.oss-fuzz.com/issues/465494996
Co-authored-by: CodeMender <codemender-patching@google.com>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* glTF2: Fix heap-buffer-overflow in Accessor validation and size calculation
This patch fixes a heap-buffer-overflow in
`glTF2::Accessor::ExtractData` caused by incorrect bounds validation and
available size reporting.
The vulnerability stemmed from two issues in `glTF2Asset.inl`:
1. **Underestimated validation in `Accessor::Read`**: The logic used
`GetBytesPerComponent() * count` to validate the required buffer
size. This failed to account for the actual `stride`, allowing
accessors to pass validation even if their total footprint
(including stride) exceeded the buffer view.
2. **Incorrect size reporting in `Accessor::GetMaxByteSize`**: The
function returned the total `bufferView->byteLength` while ignoring
the `byteOffset`. Since the accessor data starts at `byteOffset`,
the actual available space is `byteLength - byteOffset`. This led
`ExtractData` to permit reads that extended beyond the end of the
allocated buffer.
Changes:
* Modified `Accessor::Read` to use `GetStride() * count` for length
validation.
* Updated `Accessor::GetMaxByteSize` to correctly return
`bufferView->byteLength - byteOffset` for standard accessors and
`sparse->data.size()` for sparse accessors.
Co-authored-by: CodeMender <codemender-patching@google.com>
Fixes: https://issues.oss-fuzz.com/issues/483102963
* address comment
---------
Co-authored-by: CodeMender <codemender-patching@google.com>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
The mColors[0] array was allocated with m_numColors elements but
indexed up to mNumVertices (= numFaces * 3), causing an out-of-bounds
write when the color count is less than the vertex count.
Allocate mColors[0] with mNumVertices (matching mNormals and
mTextureCoords), and add a bounds check on idx before reading
from the source color array.
Fixes#6468
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
Add buffer boundary checks before reading frame data to prevent out-of-bounds reads on malformed MDL files.
Fixes#6172 (CVE-2025-5200)
Signed-off-by: mapengyuan <mapengyuan@xfusion.com>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
Add validations check in AC3DImporter::ConvertObjectSection to ensure that writing TriangleStrip vertex data does not exceed mesh->mNumVertices allocation.
Fixes#6015 (CVE-2025-2754)
Fixes#6018 (CVE-2025-2756)
Signed-off-by: mapengyuan <mapengyuan@xfusion.com>
* Update copyright year and project version
- Fixes version in lib
* Update copyright year to 2026
* Update copyright year to 2026 in Version.cpp
* Update copyright year and version patch test
* Fix copyright year
* Adapt copyrights
* Fix some recently implemented comparisons of token strings. Previously, the `keyword` included the following space along with the token, which broke the string comparison using the equality operator.
* Rename `getEndOfToken` -> `getNextDelimiter`, to reflect the actual usage
Improve bounds checks in MD3Importer::ValidateSurfaceHeaderOffsets to prevent pcSurf from accessing data outside the MD3 buffer (fixes#6070, CVE-2025-3549).
Signed-off-by: mapengyuan <mapengyuan@xfusion.com>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
- Validate ulOffsetEnd in MDCImporter::ValidateSurfaceHeader to
prevent pcSurface2 from moving past the MDC buffer(fixes#6167, CVE-2025-5165).
- Apply AI_SWAP4 to ulOffsetShaders before using it in bounds checks.
Signed-off-by: mapengyuan <mapengyuan@xfusion.com>
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
A segmentation fault occurred while parsing an MD5 file that contains an invalid vertex index.
The issue was caused by mScene->mMaterials not being kept in sync with mScene->mNumMaterials.
As a result, the aiScene destructor could call delete on uninitialized pointers. This patch
ensures that mScene->mNumMaterials always matches the actual contents of the mScene->mMaterials
array. That way, if an exception is thrown during file import, delete is only called for
properly allocated aiMaterial objects.
PR #6120 fixed a macro which previously prevented std::unordered_multimap
from being used during FBX import when compiled with GCC.
This caused FBX::Element properties to be stored in arbitrary order,
but the order of connections ("C" properties) in FBX files matters.
The main issue I saw was incorrect materials.
This changes the type of FBX::ElementMap to always use std::multimap
(i.e., ordered). This was the behavior for years under GCC while the
broken macro was in use. Unordered containers are still used elsewhere
in the FBX importer to benefit from their performance.
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
Checks if multiplying texture width and height would overflow before
performing the operation. This avoids incorrect memory allocations and
potential crashes with very large textures.
Fixes#6358
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* Add BOM skip and fix mtl parsing
* Remove old code
* Fix#5635
* Add all attributes to ObjFileData
---------
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
The loader attempted to read the MDL header without verifying if the input buffer was large enough.
Added a check in MDLImporter::InternReadFile_HL1 to ensure the buffer size is sufficient before proceeding with loading.
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* Refix export fbx PolygonVertexIndex
* Fix the function ColladaParser::ReadEffectColor when the flag ASSIMP_DOUBLE_PRESICION is enabled
* Fix the static function ReadLight in ColladaParser when the flag ASSIMP_DOUBLE_PRESICION is enabled
* Refactor of the call of the function fast_atoreal_move to the member of aiColor3D
* Fix the call of the function fast_atoreal_move when the flag ASSIMP_DOUBLE_PRESICION is enabled and and refactor
* Fix the call of the function fast_atoreal_move when the flag ASSIMP_DOUBLE_PRESICION is enabled
---------
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
* AC: Support Double-Sided Faces
The AC format marks double-sided SURF elements with the 0x20 flag, which Assimp ignored. This commit adds support for double-sided faces.
On encountering a double-sided face via the flag mentioned above, the front face is generated as usual but is then duplicated. The winding order of the duplicate is flipped to form a back face. Vertices are duplicated too so that back faces work correctly with normal vector generation and face smoothing.
* Add test file
* Simplify test case
---------
Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
