Add internal JSON backend option

Add bounds check to images loaded from bufferviews

.github/workflows/mingw-w64-msys2.yml

@@ -0,0 +1,45 @@
+name: MSYS2 MinGW-w64 Windows 64bit Build
+
+on:
+  push:
+    branches:
+      - release
+      - devel
+    paths:
+    - 'tiny_gltf.*'
+    - 'CMakeLists.txt'
+    - '.github/workflows/mingw-w64-msys2.yml'
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  mingw-w64-msys2-build:
+    name: MSYS2 MinGW-w64 Windows Build
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: msys2 {0}
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install core & build dependencies
+        uses: msys2/setup-msys2@v2
+        with:
+          msystem: UCRT64
+          install: base-devel
+          pacboy: >-
+            cc:p cmake:p ninja:p
+          update: true
+          release: false
+
+      - name: Configure
+        run: |
+          cmake \
+            -G"Ninja" \
+            -S . \
+            -B build
+
+      - name: Build
+        run: |
+          cmake --build build
+

.gitignore

@@ -24,6 +24,7 @@ premake5.tar.gz
 #binary directories
 bin/
 obj/
+out/
 
 #runtime gui config
 imgui.ini

.travis-before-install.sh

@@ -1,10 +0,0 @@
-#!/bin/bash
-
-if [[ "$TRAVIS_OS_NAME" == "osx" ]]
-then
-    brew upgrade
-    curl -o premake5.tar.gz https://github.com/premake/premake-core/releases/download/v5.0.0-alpha12/premake-5.0.0-alpha12-macosx.tar.gz
-else
-    wget https://github.com/premake/premake-core/releases/download/v5.0.0-alpha12/premake-5.0.0-alpha12-linux.tar.gz -O premake5.tar.gz
-fi
-tar xzf premake5.tar.gz

.travis.yml

@@ -1,63 +0,0 @@
-language: cpp
-sudo: false
-matrix:
-  include:
-  - addons: &1
-      apt:
-        sources:
-        - george-edison55-precise-backports
-        - ubuntu-toolchain-r-test
-        - llvm-toolchain-trusty-3.9
-        packages:
-        - g++-4.9
-        - clang-3.9
-    compiler: clang
-    env: COMPILER_VERSION=3.9 BUILD_TYPE=Debug
-  - addons: *1
-    compiler: clang
-    env: COMPILER_VERSION=3.9 BUILD_TYPE=Release
-  - addons: &2
-      apt:
-        sources:
-        - george-edison55-precise-backports
-        - ubuntu-toolchain-r-test
-        packages:
-        - g++-4.9
-    compiler: gcc
-    env: COMPILER_VERSION=4.9 BUILD_TYPE=Debug EXTRA_CXXFLAGS="-fsanitize=address"
-  - addons: *2
-    compiler: gcc
-    env: COMPILER_VERSION=4.9 BUILD_TYPE=Release EXTRA_CXXFLAGS="-fsanitize=address"
-  - addons: *1
-    compiler: clang
-    env: COMPILER_VERSION=3.9 BUILD_TYPE=Debug CFLAGS="-O0" CXXFLAGS="-O0"
-  - addons: &3
-      apt:
-        sources:
-        - ubuntu-toolchain-r-test
-        packages:
-        - g++-4.8
-    compiler: gcc
-    env: COMPILER_VERSION=4.8 BUILD_TYPE=Debug
-  - addons: *3
-    compiler: gcc
-    env: COMPILER_VERSION=4.8 BUILD_TYPE=Release
-
-before_install:
-  - ./.travis-before-install.sh
-
-
-script:
-  - export CC="${CC}-${COMPILER_VERSION}"
-  - export CXX="${CXX}-${COMPILER_VERSION}"
-  - ${CC} -v
-  - ${CXX} ${EXTRA_CXXFLAGS} -std=c++11 -Wall -g -o loader_example loader_example.cc
-  - ./loader_example ./models/Cube/Cube.gltf
-  - cd tests
-  - clang++ -v
-  - make
-  - ./tester
-  - ./tester_noexcept
-  - cd ../examples/raytrace
-  - ../../premake5 gmake
-  - make

AGENTS.md

@@ -0,0 +1,34 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+- Core library lives in `tiny_gltf.h` (header-only) with `tiny_gltf.cc` provided for the amalgamated implementation flags. Keep public API updates localized and documented.
+- Example viewers and utilities sit under `examples/`; use them as references for loading, validation, and WASM builds. Temporary build outputs belong in `build/` (git-ignored).
+- Tests reside in `tests/` with sample assets in `data/` and `models/`; avoid committing generated binaries in `build/`, `tmp/`, or `tests/tester*`.
+
+## Build, Test, and Development Commands
+- Quick build of the loader example: `make` (uses clang++, C++11, optional `EXTRA_CXXFLAGS` for sanitizers).
+- Unit tests: `cd tests && make && ./tester && ./tester_noexcept`.
+- Parsing regression run: build `loader_example`, then `python test_runner.py` (requires local glTF-Sample-Models checkout and path update inside the script).
+- CMake alternative: `cmake -S . -B build && cmake --build build` for IDE integration or non-clang toolchains.
+- Lint header: `python deps/cpplint.py tiny_gltf.h`.
+
+## Coding Style & Naming Conventions
+- C++11, two-space indent, braces on the same line; mirror existing spacing and comment style in `tiny_gltf.h`.
+- Prefer `std::` facilities and minimal dependencies; keep new symbols in the `tinygltf` namespace.
+- Public API names stay PascalCase for types and camelCase for functions; keep enums/macros consistent with existing `TINYGLTF_*` patterns.
+- Guard optional features with the established `TINYGLTF_*` defines; avoid introducing new globals without discussion.
+
+## Testing Guidelines
+- Framework: Catch2 single-header (`tests/catch.hpp`); add `TEST_CASE` blocks alongside related helpers in `tests/tester.cc`.
+- Provide coverage for both exception-enabled and `TINYGLTF_NOEXCEPTION` builds; run both `tester` binaries before submitting.
+- For new formats or parsing code, add assets under `tests/` or reference `data/` and note provenance.
+
+## Commit & Pull Request Guidelines
+- Commit messages: concise, present-tense imperatives mirroring existing history (e.g., “Add bounds check to images loaded from bufferviews”).
+- PRs should describe the change, motivation, and testing (`tester`, `tester_noexcept`, fuzzing if relevant); link related issues.
+- Include platform notes if behavior differs (Windows vs. POSIX, filesystem callbacks, WASM). Add before/after metrics when touching performance-sensitive paths.
+
+## Security & Configuration Tips
+- Handle external data defensively: validate buffer sizes, offsets, and URI handling; prefer bounded allocations.
+- Keep optional callbacks (`fs::`, URI, image) robust against untrusted input; document new failure modes.
+- Avoid committing sample assets with unclear licensing; reuse existing test fixtures where possible.

CMakeLists.txt

@@ -1,11 +1,14 @@
 cmake_minimum_required(VERSION 3.6)
 
-PROJECT (tinygltf)
+project(tinygltf)
 
 include(GNUInstallDirs)
 include(CMakePackageConfigHelpers)
 
-SET(CMAKE_CXX_STANDARD 11)
+set(CMAKE_CXX_STANDARD 11)
+set(CMAKE_CXX_STANDARD_REQUIRED On)
+set(CMAKE_CXX_EXTENSIONS Off)
+set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 
 option(TINYGLTF_BUILD_LOADER_EXAMPLE "Build loader_example(load glTF and dump infos)" ON)
 option(TINYGLTF_BUILD_GL_EXAMPLES "Build GL exampels(requires glfw, OpenGL, etc)" OFF)
@@ -13,24 +16,25 @@ option(TINYGLTF_BUILD_VALIDATOR_EXAMPLE "Build validator exampe" OFF)
 option(TINYGLTF_BUILD_BUILDER_EXAMPLE "Build glTF builder example" OFF)
 option(TINYGLTF_HEADER_ONLY "On: header-only mode. Off: create tinygltf library(No TINYGLTF_IMPLEMENTATION required in your project)" OFF)
 option(TINYGLTF_INSTALL "Install tinygltf files during install step. Usually set to OFF if you include tinygltf through add_subdirectory()" ON)
+option(TINYGLTF_INSTALL_VENDOR "Install vendored nlohmann/json and nothings/stb headers" ON)
 
 if (TINYGLTF_BUILD_LOADER_EXAMPLE)
-  ADD_EXECUTABLE ( loader_example
+  add_executable(loader_example
     loader_example.cc
     )
 endif (TINYGLTF_BUILD_LOADER_EXAMPLE)
 
 if (TINYGLTF_BUILD_GL_EXAMPLES)
-  ADD_SUBDIRECTORY ( examples/gltfutil )
-  ADD_SUBDIRECTORY ( examples/glview )
+  add_subdirectory( examples/gltfutil )
+  add_subdirectory( examples/glview )
 endif (TINYGLTF_BUILD_GL_EXAMPLES)
 
 if (TINYGLTF_BUILD_VALIDATOR_EXAMPLE)
-  ADD_SUBDIRECTORY ( examples/validator )
+  add_subdirectory( examples/validator )
 endif (TINYGLTF_BUILD_VALIDATOR_EXAMPLE)
 
 if (TINYGLTF_BUILD_BUILDER_EXAMPLE)
-  ADD_SUBDIRECTORY ( examples/build-gltf )
+  add_subdirectory ( examples/build-gltf )
 endif (TINYGLTF_BUILD_BUILDER_EXAMPLE)
 
 #
@@ -58,19 +62,26 @@ endif (TINYGLTF_HEADER_ONLY)
 
 if (TINYGLTF_INSTALL)
   install(TARGETS tinygltf EXPORT tinygltfTargets)
-  install(EXPORT tinygltfTargets NAMESPACE tinygltf:: FILE TinyGLTFTargets.cmake DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake)
+  install(EXPORT tinygltfTargets NAMESPACE tinygltf:: FILE TinyGLTFTargets.cmake DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/tinygltf)
   configure_package_config_file(${CMAKE_CURRENT_SOURCE_DIR}/cmake/TinyGLTFConfig.cmake.in ${CMAKE_CURRENT_BINARY_DIR}/TinyGLTFConfig.cmake INSTALL_DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake)
-  install(FILES ${CMAKE_CURRENT_BINARY_DIR}/TinyGLTFConfig.cmake DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake)
+  install(FILES ${CMAKE_CURRENT_BINARY_DIR}/TinyGLTFConfig.cmake DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/tinygltf)
   # Do not install .lib even if !TINYGLTF_HEADER_ONLY
 
   INSTALL ( FILES
-    json.hpp
-    stb_image.h
-    stb_image_write.h
     tiny_gltf.h
     ${TINYGLTF_EXTRA_SOUECES}
     DESTINATION
     include
     )
 
+    if(TINYGLTF_INSTALL_VENDOR)
+      INSTALL ( FILES
+        json.hpp
+        stb_image.h
+        stb_image_write.h
+        DESTINATION
+        include
+        )
+    endif()
+
 endif(TINYGLTF_INSTALL)

README.md

@@ -9,7 +9,7 @@ If you are looking for old, C++03 version, please use `devel-picojson` branch (b
 ## Status
 
 Currently TinyGLTF is stable and maintenance mode. No drastic changes and feature additions planned.
-
+ - v2.9.0 Various fixes and improvements. Filesystem callback API change.
  - v2.8.0 Add URICallbacks for custom URI handling in Buffer and Image. PR#397
  - v2.7.0 Change WriteImageDataFunction user callback function signature. PR#393
  - v2.6.0 Support serializing sparse accessor(Thanks to @fynv).
@@ -26,8 +26,6 @@ Currently TinyGLTF is stable and maintenance mode. No drastic changes and featur
 
 ## Builds
 
-[![Build Status](https://travis-ci.org/syoyo/tinygltf.svg?branch=devel)](https://travis-ci.org/syoyo/tinygltf)
-
 [![Build status](https://ci.appveyor.com/api/projects/status/warngenu9wjjhlm8?svg=true)](https://ci.appveyor.com/project/syoyo/tinygltf)
 
 ![C/C++ CI](https://github.com/syoyo/tinygltf/workflows/C/C++%20CI/badge.svg)
@@ -109,6 +107,7 @@ WASI build example is located in [wasm](wasm) .
 * [SanityEngine](https://github.com/DethRaid/SanityEngine) - A C++/D3D12 renderer focused on the personal and professional development of its developer
 * [Open3D](http://www.open3d.org/) - A Modern Library for 3D Data Processing
 * [Supernova Engine](https://github.com/supernovaengine/supernova) - Game engine for 2D and 3D projects with Lua or C++ in data oriented design.
+* [Wicked Engine<img src="https://github.com/turanszkij/WickedEngine/blob/master/Content/logo_small.png" width="28px" align="center"/>](https://github.com/turanszkij/WickedEngine) - 3D engine with modern graphics
 * Your projects here! (Please send PR)
 
 ## TODOs
@@ -197,6 +196,7 @@ if (!ret) {
 * `TINYGLTF_USE_RAPIDJSON` : Use RapidJSON as a JSON parser/serializer. RapidJSON files are not included in TinyGLTF repo. Please set an include path to RapidJSON if you enable this feature.
 * `TINYGLTF_USE_CPP14` : Use C++14 feature(requires C++14 compiler). This may give better performance than C++11.
 
+
 ## CMake options
 
 You can add tinygltf using `add_subdirectory` feature.
@@ -211,6 +211,11 @@ set(TINYGLTF_INSTALL OFF CACHE INTERNAL "" FORCE)
 add_subdirectory(/path/to/tinygltf)
 ```
 
+NOTE: Using tinygltf as a submodule doesn't automatically add the headers to your include path (as standard for many libraries). To get this functionality, add the following to the CMakeLists.txt file from above:
+
+```
+target_include_directories(${PROJECT_NAME} PRIVATE "/path/to/tinygltf")
+```
 
 ### Saving gltTF 2.0 model
 

examples/build-gltf/CMakeLists.txt

@@ -0,0 +1,5 @@
+
+include_directories(${CMAKE_SOURCE_DIR})
+add_executable(create_triangle_gltf create_triangle_gltf.cpp)
+target_compile_options(create_triangle_gltf PUBLIC -Wall)
+target_link_libraries(create_triangle_gltf )

examples/glview/glview.cc

@@ -788,8 +788,10 @@ static void QuatToAngleAxis(const std::vector<double> quaternion,
     return;
   }
 
+  constexpr double pi = 3.14159265358979323846;
+
   double denom = sqrt(1-qw*qw);
-  outAngleDegrees = angleRadians * 180.0 / M_PI;
+  outAngleDegrees = angleRadians * 180.0 / pi;
   axis[0] = qx / denom;
   axis[1] = qy / denom;
   axis[2] = qz / denom;

stb_image_write.h

@@ -773,7 +773,7 @@ static int stbi_write_hdr_core(stbi__write_context *s, int x, int y, int comp, f
 #ifdef __STDC_LIB_EXT1__
       len = sprintf_s(buffer, sizeof(buffer), "EXPOSURE=          1.0000000000000\n\n-Y %d +X %d\n", y, x);
 #else
-      len = sprintf(buffer, "EXPOSURE=          1.0000000000000\n\n-Y %d +X %d\n", y, x);
+      len = snprintf(buffer, sizeof(buffer), "EXPOSURE=          1.0000000000000\n\n-Y %d +X %d\n", y, x);
 #endif
       s->func(s->context, buffer, len);
 

tests/issue-416.gltf

@@ -0,0 +1 @@
+{"images":[{"uri":"%!QAAAQAAA5"}],"asset":{"version":""}}

tests/tester.cc

@@ -4,7 +4,9 @@
 #include "tiny_gltf.h"
 
 // Nlohmann json(include ../json.hpp)
+#if !defined(TINYGLTF_USE_INTERNAL_JSON) && !defined(TINYGLTF_USE_RAPIDJSON)
 #include "json.hpp"
+#endif
 
 #define CATCH_CONFIG_MAIN  // This tells Catch to provide a main() - only do this in one cpp file
 #include "catch.hpp"
@@ -474,7 +476,7 @@ TEST_CASE("image-uri-spaces", "[issue-236]") {
     }
     REQUIRE(true == ret);
     REQUIRE(err.empty());
-    REQUIRE(!warn.empty());  // relative image path won't exist in tests/
+    REQUIRE(warn.empty());
     REQUIRE(saved.images.size() == model.images.size());
 
     // The image uri in CubeImageUriMultipleSpaces.gltf is not encoded and
@@ -494,25 +496,23 @@ TEST_CASE("image-uri-spaces", "[issue-236]") {
 }
 
 TEST_CASE("serialize-empty-material", "[issue-294]") {
-
   tinygltf::Model m;
-
-  tinygltf::Material mat;
-  mat.pbrMetallicRoughness.baseColorFactor = {1.0f, 1.0f, 1.0f, 1.0f}; // default baseColorFactor
-  m.materials.push_back(mat);
-
+  // Add default constructed material to model
+  m.materials.push_back({});
+  // Serialize model to output stream
   std::stringstream os;
-
   tinygltf::TinyGLTF ctx;
   bool ret = ctx.WriteGltfSceneToStream(&m, os, false, false);
   REQUIRE(true == ret);
-
-  // use nlohmann json
+  // Parse serialized model
   nlohmann::json j = nlohmann::json::parse(os.str());
-
+  // Serialized materials shall hold an empty object that
+  // represents the default constructed material
+  REQUIRE(j.find("materials") != j.end());
+  REQUIRE(j["materials"].is_array());
   REQUIRE(1 == j["materials"].size());
-  REQUIRE(j["materials"][0].is_object());
-
+  CHECK(j["materials"][0].is_object());
+  CHECK(j["materials"][0].empty());
 }
 
 TEST_CASE("empty-skeleton-id", "[issue-321]") {
@@ -664,10 +664,11 @@ TEST_CASE("serialize-image-callback", "[issue-394]") {
 
   auto writer = [](const std::string *basepath, const std::string *filename,
                    const tinygltf::Image *image, bool embedImages,
-                   const tinygltf::URICallbacks *uri_cb, std::string *out_uri,
-                   void *user_pointer) -> bool {
+                   const tinygltf::FsCallbacks* fs, const tinygltf::URICallbacks *uri_cb,
+                   std::string *out_uri, void *user_pointer) -> bool {
     (void)basepath;
     (void)image;
+    (void)fs;
     (void)uri_cb;
     REQUIRE(*filename == "foo");
     REQUIRE(embedImages == true);
@@ -701,12 +702,13 @@ TEST_CASE("serialize-image-failure", "[issue-394]") {
 
   auto writer = [](const std::string *basepath, const std::string *filename,
                    const tinygltf::Image *image, bool embedImages,
-                   const tinygltf::URICallbacks *uri_cb, std::string *out_uri,
-                   void *user_pointer) -> bool {
+                   const tinygltf::FsCallbacks* fs, const tinygltf::URICallbacks *uri_cb,
+                   std::string *out_uri, void *user_pointer) -> bool {
     (void)basepath;
     (void)filename;
     (void)image;
     (void)embedImages;
+    (void)fs;
     (void)uri_cb;
     (void)out_uri;
     (void)user_pointer;
@@ -721,3 +723,717 @@ TEST_CASE("serialize-image-failure", "[issue-394]") {
   REQUIRE(false == result);
   REQUIRE(os.str().size() == 0);
 }
+
+TEST_CASE("filesize-check", "[issue-416]") {
+
+  tinygltf::Model model;
+  tinygltf::TinyGLTF ctx;
+  std::string err;
+  std::string warn;
+
+  ctx.SetMaxExternalFileSize(10); // 10 bytes. will fail to load texture image.
+
+  bool ret = ctx.LoadASCIIFromFile(&model, &err, &warn, "../models/Cube/Cube.gltf");
+  if (!err.empty()) {
+    std::cerr << err << std::endl;
+  }
+
+  REQUIRE(false == ret);
+}
+
+TEST_CASE("load-issue-416-model", "[issue-416]") {
+
+  tinygltf::Model model;
+  tinygltf::TinyGLTF ctx;
+  std::string err;
+  std::string warn;
+
+  bool ret = ctx.LoadASCIIFromFile(&model, &err, &warn, "issue-416.gltf");
+  if (!warn.empty()) {
+    std::cout << "WARN:" << warn << std::endl;
+  }
+  if (!err.empty()) {
+    std::cerr << "ERR:" << err << std::endl;
+  }
+
+  // external file load fails, but reading glTF itself is ok.
+  REQUIRE(true == ret);
+}
+
+TEST_CASE("reject-unsafe-paths", "[security]") {
+  tinygltf::TinyGLTF ctx;
+
+  SECTION("parent-directory reference is rejected") {
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+
+    const std::string gltf = R"({
+      "asset": {"version": "2.0"},
+      "buffers": [
+        {"uri": "../secret.bin", "byteLength": 4}
+      ]
+    })";
+
+    bool ret = ctx.LoadASCIIFromString(&model, &err, &warn, gltf.c_str(),
+                                       static_cast<unsigned int>(gltf.size()),
+                                       ".");
+    REQUIRE_FALSE(ret);
+    REQUIRE_THAT(err, Catch::Contains("Rejected unsafe filename"));
+  }
+
+  SECTION("absolute path is rejected") {
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+
+    const std::string gltf = R"({
+      "asset": {"version": "2.0"},
+      "buffers": [
+        {"uri": "/tmp/secret.bin", "byteLength": 4}
+      ]
+    })";
+
+    bool ret = ctx.LoadASCIIFromString(&model, &err, &warn, gltf.c_str(),
+                                       static_cast<unsigned int>(gltf.size()),
+                                       ".");
+    REQUIRE_FALSE(ret);
+    REQUIRE_THAT(err, Catch::Contains("Rejected unsafe filename"));
+  }
+}
+
+TEST_CASE("data-uri-size-limit", "[security]") {
+  tinygltf::TinyGLTF ctx;
+  ctx.SetMaxDataURISize(16);  // small limit to exercise rejection path.
+
+  const std::string payload(24, 'A');  // decodes to 18 bytes.
+  const std::string data_uri =
+      "data:application/octet-stream;base64," + payload;
+  const std::string gltf = R"({
+    "asset": {"version": "2.0"},
+    "buffers": [
+      {"uri": ")" + data_uri + R"(", "byteLength": 18}
+    ]
+  })";
+
+  tinygltf::Model model;
+  std::string err;
+  std::string warn;
+
+  bool ret = ctx.LoadASCIIFromString(&model, &err, &warn, gltf.c_str(),
+                                     static_cast<unsigned int>(gltf.size()),
+                                     ".");
+  REQUIRE_FALSE(ret);
+  REQUIRE_THAT(err,
+               Catch::Contains("Data URI for buffer exceeds maximum allowed"));
+
+  SECTION("ceiling estimation rejects near-limit payloads") {
+    tinygltf::TinyGLTF ctx2;
+    ctx2.SetMaxDataURISize(4);
+    // 8 chars base64 -> 6 decoded bytes, should be rejected by max size.
+    const std::string small_payload(8, 'A');
+    const std::string small_uri =
+        "data:application/octet-stream;base64," + small_payload;
+    const std::string gltf_small = R"({
+      "asset": {"version": "2.0"},
+      "buffers": [
+        {"uri": ")" + small_uri + R"(", "byteLength": 6}
+      ]
+    })";
+
+    tinygltf::Model m2;
+    std::string err2;
+    std::string warn2;
+    bool ok = ctx2.LoadASCIIFromString(
+        &m2, &err2, &warn2, gltf_small.c_str(),
+        static_cast<unsigned int>(gltf_small.size()), ".");
+    REQUIRE_FALSE(ok);
+    REQUIRE_THAT(err2,
+                 Catch::Contains("Data URI for buffer exceeds maximum allowed"));
+  }
+}
+
+TEST_CASE("max-external-file-size", "[security]") {
+  tinygltf::TinyGLTF ctx;
+  ctx.SetMaxExternalFileSize(16);  // small limit to force rejection.
+
+  const std::string gltf_path = "oversize.gltf";
+  {
+    std::ofstream ofs(gltf_path, std::ios::binary);
+    ofs << R"({"asset":{"version":"2.0"}})" << std::string(64, ' ');
+  }
+
+  tinygltf::Model model;
+  std::string err;
+  std::string warn;
+  bool ok = ctx.LoadASCIIFromFile(&model, &err, &warn, gltf_path);
+  REQUIRE_FALSE(ok);
+  REQUIRE_THAT(err,
+               Catch::Contains("exceeds maximum allowed file size"));
+  std::remove(gltf_path.c_str());
+
+  const std::string glb_path = "oversize.glb";
+  {
+    std::ofstream ofs(glb_path, std::ios::binary);
+    ofs << std::string(32, '\0');
+  }
+
+  err.clear();
+  warn.clear();
+  ok = ctx.LoadBinaryFromFile(&model, &err, &warn, glb_path);
+  REQUIRE_FALSE(ok);
+  REQUIRE_THAT(err,
+               Catch::Contains("exceeds maximum allowed file size"));
+  std::remove(glb_path.c_str());
+}
+
+TEST_CASE("max-size-in-memory", "[security]") {
+  tinygltf::TinyGLTF ctx;
+  ctx.SetMaxExternalFileSize(16);
+
+  // LoadASCIIFromString should reject oversized input.
+  {
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+    std::string large_json(20, ' ');
+    bool ok = ctx.LoadASCIIFromString(
+        &model, &err, &warn, large_json.c_str(),
+        static_cast<unsigned int>(large_json.size()), ".");
+    REQUIRE_FALSE(ok);
+    REQUIRE_THAT(err, Catch::Contains("Input size exceeds maximum"));
+  }
+
+  // LoadBinaryFromMemory should reject oversized input even before parsing.
+  {
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+    std::array<unsigned char, 32> bytes{};
+    // Craft minimal glTF header; size still exceeds limit and should be
+    // rejected early.
+    bytes[0] = 'g'; bytes[1] = 'l'; bytes[2] = 'T'; bytes[3] = 'F';
+    bytes[4] = 2; // version little-endian
+    bool ok = ctx.LoadBinaryFromMemory(&model, &err, &warn, bytes.data(),
+                                       static_cast<unsigned int>(bytes.size()),
+                                       ".");
+    REQUIRE_FALSE(ok);
+    REQUIRE_THAT(err, Catch::Contains("Input size exceeds maximum"));
+  }
+
+  SECTION("GLB length mismatch is rejected in strict mode") {
+    tinygltf::TinyGLTF ctx_strict;
+    ctx_strict.SetParseStrictness(tinygltf::ParseStrictness::Strict);
+
+    // Construct a minimal GLB with length field smaller than actual buffer.
+    std::array<unsigned char, 32> glb{};
+    glb[0] = 'g'; glb[1] = 'l'; glb[2] = 'T'; glb[3] = 'F';
+    glb[4] = 2; // version
+    uint32_t length = 24; // claimed length (smaller than actual buffer size)
+    memcpy(&glb[8], &length, 4);
+    uint32_t json_len = 4;
+    memcpy(&glb[12], &json_len, 4);
+    uint32_t json_fmt = 0x4E4F534A; // "JSON"
+    memcpy(&glb[16], &json_fmt, 4);
+
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+    bool ok = ctx_strict.LoadBinaryFromMemory(
+        &model, &err, &warn, glb.data(),
+        static_cast<unsigned int>(glb.size()), ".");
+    REQUIRE_FALSE(ok);
+    REQUIRE_THAT(err,
+                 Catch::Contains("Length field does not match data size"));
+  }
+}
+
+TEST_CASE("serialize-empty-node", "[issue-457]") {
+  tinygltf::Model m;
+  // Add default constructed node to model
+  m.nodes.push_back({});
+  // Add scene to model
+  m.scenes.push_back({});
+  // The scene's only node is the empty node
+  m.scenes.front().nodes.push_back(0);
+
+  // Serialize model to output stream
+  std::stringstream os;
+  tinygltf::TinyGLTF ctx;
+  bool ret = ctx.WriteGltfSceneToStream(&m, os, false, false);
+  REQUIRE(true == ret);
+
+  // Parse serialized model
+  nlohmann::json j = nlohmann::json::parse(os.str());
+
+  // Serialized nodes shall hold an empty object that
+  // represents the default constructed node
+  REQUIRE(j.find("nodes") != j.end());
+  REQUIRE(j["nodes"].is_array());
+  REQUIRE(1 == j["nodes"].size());
+  CHECK(j["nodes"][0].is_object());
+  CHECK(j["nodes"][0].empty());
+
+  // We also want to make sure that the serialized scene
+  // is referencing the empty node.
+
+  // There shall be a single serialized scene
+  auto scenes = j.find("scenes");
+  REQUIRE(scenes != j.end());
+  REQUIRE(scenes->is_array());
+  REQUIRE(1 == scenes->size());
+  auto scene = scenes->at(0);
+  REQUIRE(scene.is_object());
+  // The scene's nodes array shall hold a reference
+  // to the single node
+  auto nodes = scene.find("nodes");
+  REQUIRE(nodes != scene.end());
+  REQUIRE(nodes->is_array());
+  REQUIRE(1 == nodes->size());
+  auto node = nodes->at(0);
+  CHECK(node.is_number_integer());
+  int idx = -1;
+  node.get_to(idx);
+  CHECK(0 == idx);
+}
+
+TEST_CASE("serialize-light-index", "[issue-458]") {
+
+  // Create the light
+  tinygltf::Light light;
+  light.type = "point";
+  light.intensity = 0.75;
+  light.color = std::vector<double>{1.0, 0.8, 0.95};
+
+  // Stream to serialize to
+  std::stringstream os;
+
+  {
+    tinygltf::Model m;
+    tinygltf::Scene scene;
+    // Add the light to the model
+    m.lights.push_back(light);
+    // Create a node that uses the light
+    tinygltf::Node node;
+    node.light = 0;
+    // Add the node to the model
+    m.nodes.push_back(node);
+    // Add the node to the scene
+    scene.nodes.push_back(0);
+    // Add the scene to the model
+    m.scenes.push_back(scene);
+    // Serialize model to output stream
+    tinygltf::TinyGLTF ctx;
+    bool ret = ctx.WriteGltfSceneToStream(&m, os, false, false);
+    REQUIRE(true == ret);
+  }
+
+  {
+    tinygltf::Model m;
+    tinygltf::TinyGLTF ctx;
+    // Parse the serialized model
+    bool ok = ctx.LoadASCIIFromString(&m, nullptr, nullptr, os.str().c_str(), os.str().size(), "");
+    REQUIRE(true == ok);
+    // Check if the light was correctly serialized
+    REQUIRE(1 == m.lights.size());
+    CHECK(m.lights[0] == light);
+    // Check that the node properly references the light
+    REQUIRE(1 == m.nodes.size());
+    CHECK(m.nodes[0].light == 0);
+  }
+}
+
+TEST_CASE("default-material", "[issue-459]") {
+  const std::vector<double> default_emissive_factor{ 0.0, 0.0, 0.0 };
+  const std::vector<double> default_base_color_factor{ 1.0, 1.0, 1.0, 1.0 };
+  const std::string default_alpha_mode = "OPAQUE";
+  const double default_alpha_cutoff = 0.5;
+  const bool default_double_sided = false;
+  const double default_metallic_factor = 1.0;
+  const double default_roughness_factor = 1.0;
+  // Check that default constructed material
+  // holds actual default GLTF material properties
+  tinygltf::Material mat;
+  CHECK(mat.alphaMode == default_alpha_mode);
+  CHECK(mat.alphaCutoff == default_alpha_cutoff);
+  CHECK(mat.doubleSided == default_double_sided);
+  CHECK(mat.emissiveFactor == default_emissive_factor);
+  CHECK(mat.pbrMetallicRoughness.baseColorFactor == default_base_color_factor);
+  CHECK(mat.pbrMetallicRoughness.metallicFactor == default_metallic_factor);
+  CHECK(mat.pbrMetallicRoughness.roughnessFactor == default_roughness_factor);
+  // None of the textures should be set
+  CHECK(mat.normalTexture.index == -1);
+  CHECK(mat.occlusionTexture.index == -1);
+  CHECK(mat.emissiveTexture.index == -1);
+}
+
+TEST_CASE("serialize-empty-scene", "[issue-464]") {
+  // Stream to serialize to
+  std::stringstream os;
+
+  {
+    tinygltf::Model m;
+    // Add empty scene to the model
+    m.scenes.push_back({});
+    // Serialize model to output stream
+    tinygltf::TinyGLTF ctx;
+    bool ret = ctx.WriteGltfSceneToStream(&m, os, false, false);
+    REQUIRE(true == ret);
+  }
+
+  {
+    tinygltf::Model m;
+    tinygltf::TinyGLTF ctx;
+    // Parse the serialized model
+    bool ok = ctx.LoadASCIIFromString(&m, nullptr, nullptr, os.str().c_str(), os.str().size(), "");
+    REQUIRE(true == ok);
+    // Make sure the empty scene is there
+    REQUIRE(1 == m.scenes.size());
+    tinygltf::Scene scene{};
+    // Check that the scene is empty
+    CHECK(m.scenes[0] == scene);
+  }
+}
+
+TEST_CASE("zero-sized-bin-chunk-glb", "[issue-440]") {
+
+  tinygltf::Model model;
+  tinygltf::TinyGLTF ctx;
+  std::string err;
+  std::string warn;
+
+  // Input glb has zero-sized data in bin chunk(8 bytes for BIN chunk, and chunksize == 0)
+  // The spec https://registry.khronos.org/glTF/specs/2.0/glTF-2.0.html#binary-buffer says
+  //
+  // When the binary buffer is empty or when it is stored by other means, this chunk SHOULD be omitted.
+  //
+  // 'SHOULD' mean 'RECOMMENDED', so we'll need to allow such zero-sized bin chunk is NOT omitted.
+  bool ret = ctx.LoadBinaryFromFile(&model, &err, &warn, "../models/regression/zero-sized-bin-chunk-issue-440.glb");
+  if (!warn.empty()) {
+    std::cout << "WARN: " << warn << "\n";
+  }
+  if (!err.empty()) {
+    std::cerr << err << std::endl;
+  }
+
+  REQUIRE(true == ret);
+}
+
+TEST_CASE("serialize-node-emitter", "[KHR_audio]") {
+  // Stream to serialize to
+  std::stringstream os;
+
+  {
+    tinygltf::Model m;
+    // Create a default audio emitter
+    m.audioEmitters.resize(1);
+    // Create a single node
+    m.nodes.resize(1);
+    // The node references the single emitter
+    m.nodes[0].emitter = 0;
+    // Create a single scene
+    m.scenes.resize(1);
+    // Make the scene reference the single node
+    m.scenes[0].nodes.push_back(0);
+
+    // Serialize model to output stream
+    tinygltf::TinyGLTF ctx;
+    bool ret = ctx.WriteGltfSceneToStream(&m, os, false, false);
+    REQUIRE(true == ret);
+  }
+
+  {
+    tinygltf::Model m;
+    tinygltf::TinyGLTF ctx;
+    // Parse the serialized model
+    bool ok = ctx.LoadASCIIFromString(&m, nullptr, nullptr, os.str().c_str(), os.str().size(), "");
+    REQUIRE(true == ok);
+
+    // Make sure the single scene is there
+    REQUIRE(1 == m.scenes.size());
+    // Make sure all three nodes are there
+    REQUIRE(1 == m.nodes.size());
+    // Make sure the single root node of the scene is there
+    REQUIRE(1 == m.scenes[0].nodes.size());
+    REQUIRE(0 == m.scenes[0].nodes[0]);
+    // Retrieve the scene root node
+    const tinygltf::Node& node = m.nodes[m.scenes[0].nodes[0]];
+    // Make sure the single root node has both lod nodes
+    REQUIRE(0 == node.emitter);
+  }
+}
+
+TEST_CASE("serialize-lods", "[lods]") {
+  // Stream to serialize to
+  std::stringstream os;
+
+  {
+    tinygltf::Model m;
+
+    m.nodes.resize(4);
+    // Add Node 1 and Node 2 as lods to Node 0
+    m.nodes[0].lods.push_back(1);
+    m.nodes[0].lods.push_back(2);
+
+    // Add Material 1 and Material 2 as lods to Material 0
+    m.materials.resize(4);
+    m.materials[0].lods.push_back(1);
+    m.materials[0].lods.push_back(2);
+
+    tinygltf::Scene scene;
+    // Scene uses Node 0 and 3 as root node
+    scene.nodes.push_back(0);
+    scene.nodes.push_back(3);
+    // Add scene to the model
+    m.scenes.push_back(scene);
+
+    // Serialize model to output stream
+    tinygltf::TinyGLTF ctx;
+    bool ret = ctx.WriteGltfSceneToStream(&m, os, false, false);
+    REQUIRE(true == ret);
+  }
+
+  {
+    tinygltf::Model m;
+    tinygltf::TinyGLTF ctx;
+    // Parse the serialized model
+    bool ok = ctx.LoadASCIIFromString(&m, nullptr, nullptr, os.str().c_str(), os.str().size(), "");
+    REQUIRE(true == ok);
+    // Make sure the model's used extensions hold MSFT_lod
+    CHECK(m.extensionsUsed.size() == 1);
+    CHECK(m.extensionsUsed[0].compare("MSFT_lod") == 0);
+    // MSFT_lod is not a required extension
+    CHECK(m.extensionsRequired.size() == 0);
+
+    // Make sure all four materials are there
+    REQUIRE(4 == m.materials.size());
+    // Make sure the first material has both lod materials
+    REQUIRE(2 == m.materials[0].lods.size());
+    // Make sure the order is still the same after serialization and deserialization
+    CHECK(1 == m.materials[0].lods[0]);
+    CHECK(2 == m.materials[0].lods[1]);
+    // Make sure the material with lods exposes the MSFT_lod extension
+    CHECK(m.materials[0].extensions.size() == 1);
+    CHECK(m.materials[0].extensions.count("MSFT_lod") == 1);
+    // Make sure the last material has no lod materials
+    CHECK(0 == m.materials[3].lods.size());
+    // Make sure the material without lods does not exposes the MSFT_lod extension
+    CHECK(m.materials[3].extensions.size() == 0);
+    CHECK(m.materials[3].extensions.count("MSFT_lod") == 0);
+
+    // Make sure the single scene is there
+    REQUIRE(1 == m.scenes.size());
+    // Make sure all four nodes are there
+    REQUIRE(4 == m.nodes.size());
+    // Make sure the two root nodes of the scene are there
+    REQUIRE(2 == m.scenes[0].nodes.size());
+    REQUIRE(0 == m.scenes[0].nodes[0]);
+    REQUIRE(3 == m.scenes[0].nodes[1]);
+    // Retrieve the node with lods
+    const tinygltf::Node& nodeWithLods = m.nodes[m.scenes[0].nodes[0]];
+    // Make sure the node has both lod nodes
+    REQUIRE(2 == nodeWithLods.lods.size());
+    // Make sure the order is still the same after serialization and deserialization
+    CHECK(1 == nodeWithLods.lods[0]);
+    CHECK(2 == nodeWithLods.lods[1]);
+    // Make sure the node with lods exposes the MSFT_lod extension
+    CHECK(nodeWithLods.extensions.size() == 1);
+    CHECK(nodeWithLods.extensions.count("MSFT_lod") == 1);
+    // Retrieve the node without lods
+    const tinygltf::Node& nodeWithoutLods = m.nodes[m.scenes[0].nodes[1]];
+    // Make sure the node has no lod nodes
+    CHECK(0 == nodeWithoutLods.lods.size());
+    // Make sure the node without lods does not exposes the MSFT_lod extension
+    CHECK(nodeWithoutLods.extensions.size() == 0);
+    CHECK(nodeWithoutLods.extensions.count("MSFT_lod") == 0);
+  }
+}
+
+TEST_CASE("write-image-issue", "[issue-473]") {
+  std::string err;
+  std::string warn;
+  tinygltf::Model model;
+  tinygltf::TinyGLTF ctx;
+  bool ok = ctx.LoadASCIIFromFile(&model, &err, &warn, "../models/Cube/Cube.gltf");
+  REQUIRE(ok);
+  REQUIRE(err.empty());
+  REQUIRE(warn.empty());
+
+  REQUIRE(model.images.size() == 2);
+  REQUIRE(model.images[0].uri == "Cube_BaseColor.png");
+  REQUIRE(model.images[1].uri == "Cube_MetallicRoughness.png");
+
+  REQUIRE_FALSE(model.images[0].image.empty());
+  REQUIRE_FALSE(model.images[1].image.empty());
+
+  ok = ctx.WriteGltfSceneToFile(&model, "Cube.gltf");
+  REQUIRE(ok);
+
+  for (const auto& image : model.images) {
+    std::fstream file(image.uri);
+    CHECK(file.good());
+  }
+}
+
+TEST_CASE("images-as-is", "[issue-487]") {
+  std::string err;
+  std::string warn;
+  tinygltf::Model model;
+  tinygltf::TinyGLTF ctx;
+  ctx.SetImagesAsIs(true);
+  bool ok = ctx.LoadASCIIFromFile(&model, &err, &warn, "../models/Cube/Cube.gltf");
+  REQUIRE(ok);
+  REQUIRE(err.empty());
+  REQUIRE(warn.empty());
+
+  for (const auto& image : model.images) {
+    CHECK(image.as_is == true);
+    CHECK_FALSE(image.uri.empty());
+    CHECK_FALSE(image.image.empty());
+
+#ifndef TINYGLTF_NO_STB_IMAGE
+    // Make sure we can decode the images
+    int w = -1, h = -1, component = -1;
+    unsigned char *data = stbi_load_from_memory(image.image.data(), static_cast<int>(image.image.size()), &w, &h, &component, 0);
+    CHECK(data != nullptr);
+    CHECK(w == 512);
+    CHECK(h == 512);
+    CHECK(component >= 3);
+    stbi_image_free(data);
+#endif
+  }
+
+  // Write glTF model to disk, and images as separate files
+  {
+    ok = ctx.WriteGltfSceneToFile(&model, "Cube_with_image_files.gltf");
+    REQUIRE(ok);
+
+    // All the images should have been written to disk with their original data
+    for (const auto& image : model.images)  {
+      // Make sure the image files exist
+      std::fstream file(image.uri);
+      CHECK(file.good());
+#ifndef TINYGLTF_NO_STB_IMAGE
+      // Make sure we can load the images
+      int w = -1, h = -1, component = -1;
+      unsigned char *data = stbi_load(image.uri.c_str(), &w, &h, &component, 0);
+      CHECK(data != nullptr);
+      CHECK(w == 512);
+      CHECK(h == 512);
+      CHECK(component >= 3);
+      stbi_image_free(data);
+#endif
+    }
+  }
+
+  // Write glTF model to disk, and embed images as data URIs
+  {
+    ok = ctx.WriteGltfSceneToFile(&model, "Cube_with_embedded_images.gltf", true, false);
+    REQUIRE(ok);
+
+    // Load above model again, and check if the images are loaded properly
+    tinygltf::Model embeddedImages;
+    ctx.SetImagesAsIs(false);
+    bool ok = ctx.LoadASCIIFromFile(&embeddedImages, &err, &warn, "Cube_with_embedded_images.gltf");
+    REQUIRE(ok);
+    REQUIRE(err.empty());
+    REQUIRE(warn.empty());
+
+    for (const auto& image : embeddedImages.images) {
+      CHECK(image.as_is == false);
+      CHECK_FALSE(image.mimeType.empty());
+      CHECK_FALSE(image.image.empty());
+      CHECK(image.width == 512);
+      CHECK(image.height == 512);
+      CHECK(image.component >= 3);
+    }
+  }
+
+  // Write glTF model to disk, as GLB
+  {
+    ok = ctx.WriteGltfSceneToFile(&model, "Cube.glb", true, true, true, true);
+    REQUIRE(ok);
+
+    // Load above model again, and check if the images are loaded properly
+    tinygltf::Model glbModel;
+    ctx.SetImagesAsIs(false);
+    bool ok = ctx.LoadBinaryFromFile(&glbModel, &err, &warn, "Cube.glb");
+    REQUIRE(ok);
+    REQUIRE(err.empty());
+    REQUIRE(warn.empty());
+
+    for (const auto& image : glbModel.images) {
+      CHECK(image.as_is == false);
+      CHECK_FALSE(image.mimeType.empty());
+      CHECK_FALSE(image.image.empty());
+      CHECK(image.width == 512);
+      CHECK(image.height == 512);
+      CHECK(image.component >= 3);
+    }
+  }
+}
+
+TEST_CASE("inverse-bind-matrices-optional", "[issue-492]") {
+  tinygltf::Model model;
+  tinygltf::TinyGLTF ctx;
+  std::string err;
+  std::string warn;
+
+  bool ret = ctx.LoadBinaryFromFile(&model, &err, &warn, "issue-492.glb");
+  if (!warn.empty()) {
+    std::cout << "WARN:" << warn << std::endl;
+  }
+  if (!err.empty()) {
+    std::cerr << "ERR:" << err << std::endl;
+  }
+
+  REQUIRE(true == ret);
+  REQUIRE(err.empty());
+}
+
+bool LoadImageData(tinygltf::Image * /* image */, const int /* image_idx */, std::string * /* err */,
+                   std::string * /* warn */, int /* req_width */, int /* req_height */,
+                   const unsigned char * /* bytes */, int /* size */, void * /*user_data */) {
+    return true;
+}
+
+bool WriteImageData(const std::string * /* basepath */, const std::string * /* filename */,
+                    const tinygltf::Image *image, bool /* embedImages */,
+                    const tinygltf::FsCallbacks * /* fs_cb */, const tinygltf::URICallbacks * /* uri_cb */,
+                    std::string * /* out_uri */, void * user_pointer) {
+    REQUIRE(user_pointer != nullptr);
+    auto counter = static_cast<int*>(user_pointer);
+    *counter = *counter + 1;
+    return true;
+}
+
+TEST_CASE("empty-images-not-written", "[issue-495]") {
+  std::string err;
+  std::string warn;
+  tinygltf::Model model;
+  tinygltf::TinyGLTF ctx;
+
+  ctx.SetImageLoader(LoadImageData, nullptr);
+  bool ok = ctx.LoadASCIIFromFile(&model, &err, &warn, "../models/Cube/Cube.gltf");
+  REQUIRE(ok);
+  REQUIRE(err.empty());
+  REQUIRE(warn.empty());
+
+  CHECK(model.images.size() == 2);
+  for (const auto& image : model.images) {
+    // No data loaded or decoded
+    CHECK(image.image.empty());
+    // The URI is kept
+    CHECK_FALSE(image.uri.empty());
+    // The URI should not be a data URI
+    CHECK(image.uri.find("data:") != 0);
+  }
+
+  // Now write the loaded model
+  int counter = 0;
+  ctx.SetImageWriter(WriteImageData, &counter);
+  ok = ctx.WriteGltfSceneToFile(&model, "issue-495-external.gltf");
+  CHECK(ok);
+  // WriteImageData should be invoked for both images
+  CHECK(counter == 2);
+}