Escalate v3 C warning levels in CI to catch latent issues:
gcc/clang now run with -Werror, clang adds -Weverything (with a
small irreducible suppression list for -Wpadded, -Wunsafe-buffer-usage,
-Wcast-align, etc.), and a new MSVC job builds tester_v3_c with /W4 /WX.
Source fixes to clear the elevated warnings:
- tg3__arena_new_block: cast through void* to silence -Wcast-align.
- tg3__value_to_json: handle TG3_VALUE_BINARY explicitly and drop the
default label so -Wswitch-enum and -Wcovered-switch-default agree.
- Drop unused tg3__json_set_value_copy.
- tinygltf_json_c.h: enumerate all tg3json_value_type cases in
tg3json_value_free / tg3json_value_copy / tg3json__stringify_value_ex.
- tester_v3_c_v1port FAIL macro: split the format/newline prints so it
no longer relies on the GNU `, ##__VA_ARGS__` extension.
Verified: clang -Werror -Weverything builds clean, 13/13 internal
tests, 18/18 v1-port tests, and 134/134 cross-version regression all
pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
tests/tester_v3_c_v1port.c mirrors 18 parse/load test cases from
tester.cc against the pure-C v3 runtime: parse-error, datauri-in-glb,
extension-with-empty-object, extension-overwrite, four bounds-checking
cases, glb-invalid-length, integer-out-of-bounds,
pbr-khr-texture-transform (verifies KHR_texture_transform scale via
tg3_value introspection), image-uri-spaces (single + multiple),
empty-skeleton-id, filesize-check, load-issue-416-model,
zero-sized-bin-chunk-glb, images-as-is, inverse-bind-matrices-optional,
default-material. Header comment lists tester.cc cases skipped because
they exercise the v3 writer or v1-internal helpers (out of scope).
Wiring max_external_file_size in the parser exposed by the
filesize-check port: the option was declared in tg3_parse_options but
never enforced. tg3__load_external_file now rejects loaded files larger
than the cap with TG3_ERR_FILE_TOO_LARGE and frees the buffer the fs
callback returned to avoid a leak. The 134-model verifier and the
existing tester_v3_c security regressions still pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Threat model: parser is intended for server-side processing of attacker-
supplied glTF/GLB. Two adversarial review rounds plus a 1-hour libFuzzer
run (4 workers, ASan+UBSan, ~420M execs total, zero new artifacts) drove
this set of fixes. Concrete PoCs in tests/v3/security/ confirmed each
issue was exploitable on the prior code.
Path traversal (CRITICAL): tg3__load_external_file concatenated base_dir
with the JSON-supplied URI verbatim. A glTF with
"uri":"../../../tmp/secret" successfully loaded the file from outside
base_dir (verified by FNV64 match). New tg3__uri_is_safe rejects empty,
NUL, leading / or \\, Windows drive prefixes, and any '..' segment.
Path-buffer length checks switched to saturating subtraction so 32-bit
size_t cannot wrap.
Sign-coercion in byteStride: int32_t -1 was cast directly to uint32_t,
producing 0xFFFFFFFF and propagating into downstream count*stride math.
Restrict to glTF spec range: 0 (tightly packed) or [4, 252].
Index validation: parsed int32 index fields (accessor.bufferView,
primitive.indices/material/attributes, node.mesh/skin/camera/light,
scene.nodes[], skin.joints[], animation channel/sampler refs, MSFT_lod
ids, KHR_audio emitter/source refs, etc.) were stored unchecked. New
tg3__validate_indices walks every index field and returns
TG3_ERR_INVALID_INDEX on out-of-range. Gated by
tg3_parse_options.validate_indices, defaulting to 1.
Use-after-free on parse failure (PRE-EXISTING, surfaced by ASan during
fix verification): tg3_parse and tg3_parse_glb destroyed model->arena_
on error paths, but error messages on the user-facing tg3_error_stack
were arena-allocated. Any caller reading errors.entries[i].message
after parse failure read freed memory. tg3_model_free is now sole arena
owner; arena lives across error paths so messages stay valid until the
caller frees the model.
Other fixes:
- tg3_parse_glb: hoist tg3__model_init before header parse so callers
can safely tg3_model_free on header failure.
- tg3__parse_primitive morph targets: when arena alloc returns NULL,
pair with target_counts[ti]=0 so validators do not deref.
- Defensive 'if (!tarr) continue' in the morph-target validator loop.
- New Security Considerations block in tiny_gltf_v3.h documents the
threat model, default-on validation, fs-callback contract, and error
message lifetime.
Verification: 13 internal tests in tester_v3_c (incl. 7 new security
regressions covering path traversal absolute and relative, fs-callback
no-call assertion, byteStride wrap, OOB index, opt-in raw mode, ext
fields, and arena-message lifetime), 134/134 Khronos sample models
match v1 ground truth digest, 1-hour ASan+UBSan fuzz on the final code
clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds a structured DIGEST block (asset, buffers w/ FNV-1a hash, bufferViews,
accessors w/ min/max, mesh primitives w/ sorted attribute maps, nodes w/
normalized TRS+matrix, materials, textures/samplers/images, skins,
animations, cameras, scenes) emitted by both loader_example (v1) and
tester_v3_c (v3 C, now accepting a file arg). test_runner.py runs both,
diffs the digests, and reports counts/digest mismatches with v1 as truth.
Also rolls in /simplify follow-ups on top of 7f736d1: a shared
tg3__json_number_to_double helper to dedupe inline number coercions, a
collapsed fuzz_gltf_v3_c harness using a single tg3_fuzz_run dispatcher,
a rewritten max_safe_uint64_real comment explaining the 53-bit mantissa
constraint, and a tests/Makefile fix so tester_v3_c is a real prerequisite
of `all` (built once via the dedicated rule, not duplicated).
Verifier passes 134/134 on the Khronos glTF-Sample-Models/2.0 suite.
bufferView.target and image.mime_type/uri are intentionally excluded from
the digest: v1 infers target from accessor usage and rewrites image
URIs/mime via stb_image, neither of which is a parse-fidelity concern.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reject non-finite/out-of-range JSON numbers in int32/uint64 fields and
array/attribute elements instead of silently truncating, initialize the
model on parse-file failure, and free the partial JSON document when the
root is not an object. Adds a pure-C libFuzzer harness (fuzz_gltf_v3_c)
alongside the existing C++ one and tests covering the new failure modes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Introduce a C-first TinyGLTF v3 runtime in tiny_gltf_v3.c with a pure-C JSON backend, hook the public header to the new implementation, and add CMake/test coverage for parse and write round-trips.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add tests/v3/fuzzer/ with libFuzzer harness covering all four parse
paths (auto-detect, JSON, GLB, float32 mode) with ASan+UBSan.
Fix two bugs found by 10+ hours of fuzzing (~23M iterations):
1. UB: (int64_t)inf in cj_parse_number when extreme exponents like
22222222e222222 produce infinity. Add cj_dbl_to_i64() that clamps
inf/NaN/out-of-range values before casting.
2. Null deref in tg3__parse_string when glTF array elements are not
JSON objects (e.g. "scenes": [[3]]). Add is_object() validation
in TG3__PARSE_ARRAY_SIMPLE and TG3__PARSE_ARRAY_IDX macros.
Verified clean: 5.8M additional runs with zero crashes after fixes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add TINYGLTF_BUILD_TESTS option to build unit tests via CMake
- Test runs from tests/ directory so relative paths work correctly
- Fix Windows file sharing violation in images-as-is test by closing
fstream before stbi_load attempts to open the same file
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
tinygltf.h - serialize empty scenes as empty json objects; tester.cc - ad respective test case, bring test cases in correct order, tag test case for light index with correct issue number and fix it to compare to deserialozed model
tiny_gltf.h - access correct json object when serializing a light, this fixes an assert and causes us to serialze the light index properly; tester.cc - add respective testcase
- Add feature to limit file size for external resources(images, buffers)
- Use strlen to correctly retrieve a string from a string which contains multiple null-characters.
- Return fail when opening a directory(Posix only). Fixes#416
Tinygltf is able to write files defined by a URI, so it needs to be able
to decode it. Since it may also modify the path where the image is saved
it may need to re-encode the URI too. This patch provides an API to set
URI encoding and decoding callbacks and exposes the default decode
method.
Uses the existing dlib::urldecode as a decode default. The encode
callback is left null, matching existing behaviour.
Updates the WriteImageDataFunction signature to include
tinygltf::URICallbacks.
Decodes the image and buffer uris before using them as a filename.
If the encode callback is set, encodes the written image location in the
default WriteImageDataFunction and encodes generated buffer locations
when writing .bin files.
Adds a save+load step to the test image-uri-spaces to verify uri
encoding.
Modifies UpdateImageObject() so that Returning false from the
WriteImageDataFunction callback results in the WriteGltfScene*() call
returning false.
Does not call WriteImageDataFunction if there is no image data.
Adds test case serialize-image-failure to verify the callback return
code is able to cause an overall failure to save the gltf.
Adds 'const' to all Serialize*() methods.
Updates WriteImageData callback to take a URI out pointer that was
previously being written to the Image::uri, which is now const.
This breaks the WriteImageData API and as a side effect, Image::uri will
no longer contain the written image URI after saving.
Adds test serialize-const-image, which verifies the model's image is not
changed (because it's const), but the uri written to the gltf json is
still correct.
Adds test serialize-image-callback that defines a WriteImageDataFunction
and also verifies the uri can be overwritten.
This allows multiple gltf's to be loaded/saved in parallel. It removes the restriction of a single JsonDocument active at once which is default behavior. Enable with TINYGLTF_USE_RAPIDJSON_CRTALLOCATOR
