Add internal JSON backend option

Add bounds check to images loaded from bufferviews

AGENTS.md

@@ -0,0 +1,34 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+- Core library lives in `tiny_gltf.h` (header-only) with `tiny_gltf.cc` provided for the amalgamated implementation flags. Keep public API updates localized and documented.
+- Example viewers and utilities sit under `examples/`; use them as references for loading, validation, and WASM builds. Temporary build outputs belong in `build/` (git-ignored).
+- Tests reside in `tests/` with sample assets in `data/` and `models/`; avoid committing generated binaries in `build/`, `tmp/`, or `tests/tester*`.
+
+## Build, Test, and Development Commands
+- Quick build of the loader example: `make` (uses clang++, C++11, optional `EXTRA_CXXFLAGS` for sanitizers).
+- Unit tests: `cd tests && make && ./tester && ./tester_noexcept`.
+- Parsing regression run: build `loader_example`, then `python test_runner.py` (requires local glTF-Sample-Models checkout and path update inside the script).
+- CMake alternative: `cmake -S . -B build && cmake --build build` for IDE integration or non-clang toolchains.
+- Lint header: `python deps/cpplint.py tiny_gltf.h`.
+
+## Coding Style & Naming Conventions
+- C++11, two-space indent, braces on the same line; mirror existing spacing and comment style in `tiny_gltf.h`.
+- Prefer `std::` facilities and minimal dependencies; keep new symbols in the `tinygltf` namespace.
+- Public API names stay PascalCase for types and camelCase for functions; keep enums/macros consistent with existing `TINYGLTF_*` patterns.
+- Guard optional features with the established `TINYGLTF_*` defines; avoid introducing new globals without discussion.
+
+## Testing Guidelines
+- Framework: Catch2 single-header (`tests/catch.hpp`); add `TEST_CASE` blocks alongside related helpers in `tests/tester.cc`.
+- Provide coverage for both exception-enabled and `TINYGLTF_NOEXCEPTION` builds; run both `tester` binaries before submitting.
+- For new formats or parsing code, add assets under `tests/` or reference `data/` and note provenance.
+
+## Commit & Pull Request Guidelines
+- Commit messages: concise, present-tense imperatives mirroring existing history (e.g., “Add bounds check to images loaded from bufferviews”).
+- PRs should describe the change, motivation, and testing (`tester`, `tester_noexcept`, fuzzing if relevant); link related issues.
+- Include platform notes if behavior differs (Windows vs. POSIX, filesystem callbacks, WASM). Add before/after metrics when touching performance-sensitive paths.
+
+## Security & Configuration Tips
+- Handle external data defensively: validate buffer sizes, offsets, and URI handling; prefer bounded allocations.
+- Keep optional callbacks (`fs::`, URI, image) robust against untrusted input; document new failure modes.
+- Avoid committing sample assets with unclear licensing; reuse existing test fixtures where possible.

CMakeLists.txt

@@ -16,6 +16,7 @@ option(TINYGLTF_BUILD_VALIDATOR_EXAMPLE "Build validator exampe" OFF)
 option(TINYGLTF_BUILD_BUILDER_EXAMPLE "Build glTF builder example" OFF)
 option(TINYGLTF_HEADER_ONLY "On: header-only mode. Off: create tinygltf library(No TINYGLTF_IMPLEMENTATION required in your project)" OFF)
 option(TINYGLTF_INSTALL "Install tinygltf files during install step. Usually set to OFF if you include tinygltf through add_subdirectory()" ON)
+option(TINYGLTF_INSTALL_VENDOR "Install vendored nlohmann/json and nothings/stb headers" ON)
 
 if (TINYGLTF_BUILD_LOADER_EXAMPLE)
   add_executable(loader_example
@@ -61,19 +62,26 @@ endif (TINYGLTF_HEADER_ONLY)
 
 if (TINYGLTF_INSTALL)
   install(TARGETS tinygltf EXPORT tinygltfTargets)
-  install(EXPORT tinygltfTargets NAMESPACE tinygltf:: FILE TinyGLTFTargets.cmake DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake)
+  install(EXPORT tinygltfTargets NAMESPACE tinygltf:: FILE TinyGLTFTargets.cmake DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/tinygltf)
   configure_package_config_file(${CMAKE_CURRENT_SOURCE_DIR}/cmake/TinyGLTFConfig.cmake.in ${CMAKE_CURRENT_BINARY_DIR}/TinyGLTFConfig.cmake INSTALL_DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake)
-  install(FILES ${CMAKE_CURRENT_BINARY_DIR}/TinyGLTFConfig.cmake DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake)
+  install(FILES ${CMAKE_CURRENT_BINARY_DIR}/TinyGLTFConfig.cmake DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/tinygltf)
   # Do not install .lib even if !TINYGLTF_HEADER_ONLY
 
   INSTALL ( FILES
-    json.hpp
-    stb_image.h
-    stb_image_write.h
     tiny_gltf.h
     ${TINYGLTF_EXTRA_SOUECES}
     DESTINATION
     include
     )
 
+    if(TINYGLTF_INSTALL_VENDOR)
+      INSTALL ( FILES
+        json.hpp
+        stb_image.h
+        stb_image_write.h
+        DESTINATION
+        include
+        )
+    endif()
+
 endif(TINYGLTF_INSTALL)

README.md

@@ -9,7 +9,7 @@ If you are looking for old, C++03 version, please use `devel-picojson` branch (b
 ## Status
 
 Currently TinyGLTF is stable and maintenance mode. No drastic changes and feature additions planned.
-
+ - v2.9.0 Various fixes and improvements. Filesystem callback API change.
  - v2.8.0 Add URICallbacks for custom URI handling in Buffer and Image. PR#397
  - v2.7.0 Change WriteImageDataFunction user callback function signature. PR#393
  - v2.6.0 Support serializing sparse accessor(Thanks to @fynv).
@@ -211,6 +211,11 @@ set(TINYGLTF_INSTALL OFF CACHE INTERNAL "" FORCE)
 add_subdirectory(/path/to/tinygltf)
 ```
 
+NOTE: Using tinygltf as a submodule doesn't automatically add the headers to your include path (as standard for many libraries). To get this functionality, add the following to the CMakeLists.txt file from above:
+
+```
+target_include_directories(${PROJECT_NAME} PRIVATE "/path/to/tinygltf")
+```
 
 ### Saving gltTF 2.0 model
 

tests/tester.cc

@@ -4,7 +4,9 @@
 #include "tiny_gltf.h"
 
 // Nlohmann json(include ../json.hpp)
+#if !defined(TINYGLTF_USE_INTERNAL_JSON) && !defined(TINYGLTF_USE_RAPIDJSON)
 #include "json.hpp"
+#endif
 
 #define CATCH_CONFIG_MAIN  // This tells Catch to provide a main() - only do this in one cpp file
 #include "catch.hpp"
@@ -758,6 +760,194 @@ TEST_CASE("load-issue-416-model", "[issue-416]") {
   REQUIRE(true == ret);
 }
 
+TEST_CASE("reject-unsafe-paths", "[security]") {
+  tinygltf::TinyGLTF ctx;
+
+  SECTION("parent-directory reference is rejected") {
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+
+    const std::string gltf = R"({
+      "asset": {"version": "2.0"},
+      "buffers": [
+        {"uri": "../secret.bin", "byteLength": 4}
+      ]
+    })";
+
+    bool ret = ctx.LoadASCIIFromString(&model, &err, &warn, gltf.c_str(),
+                                       static_cast<unsigned int>(gltf.size()),
+                                       ".");
+    REQUIRE_FALSE(ret);
+    REQUIRE_THAT(err, Catch::Contains("Rejected unsafe filename"));
+  }
+
+  SECTION("absolute path is rejected") {
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+
+    const std::string gltf = R"({
+      "asset": {"version": "2.0"},
+      "buffers": [
+        {"uri": "/tmp/secret.bin", "byteLength": 4}
+      ]
+    })";
+
+    bool ret = ctx.LoadASCIIFromString(&model, &err, &warn, gltf.c_str(),
+                                       static_cast<unsigned int>(gltf.size()),
+                                       ".");
+    REQUIRE_FALSE(ret);
+    REQUIRE_THAT(err, Catch::Contains("Rejected unsafe filename"));
+  }
+}
+
+TEST_CASE("data-uri-size-limit", "[security]") {
+  tinygltf::TinyGLTF ctx;
+  ctx.SetMaxDataURISize(16);  // small limit to exercise rejection path.
+
+  const std::string payload(24, 'A');  // decodes to 18 bytes.
+  const std::string data_uri =
+      "data:application/octet-stream;base64," + payload;
+  const std::string gltf = R"({
+    "asset": {"version": "2.0"},
+    "buffers": [
+      {"uri": ")" + data_uri + R"(", "byteLength": 18}
+    ]
+  })";
+
+  tinygltf::Model model;
+  std::string err;
+  std::string warn;
+
+  bool ret = ctx.LoadASCIIFromString(&model, &err, &warn, gltf.c_str(),
+                                     static_cast<unsigned int>(gltf.size()),
+                                     ".");
+  REQUIRE_FALSE(ret);
+  REQUIRE_THAT(err,
+               Catch::Contains("Data URI for buffer exceeds maximum allowed"));
+
+  SECTION("ceiling estimation rejects near-limit payloads") {
+    tinygltf::TinyGLTF ctx2;
+    ctx2.SetMaxDataURISize(4);
+    // 8 chars base64 -> 6 decoded bytes, should be rejected by max size.
+    const std::string small_payload(8, 'A');
+    const std::string small_uri =
+        "data:application/octet-stream;base64," + small_payload;
+    const std::string gltf_small = R"({
+      "asset": {"version": "2.0"},
+      "buffers": [
+        {"uri": ")" + small_uri + R"(", "byteLength": 6}
+      ]
+    })";
+
+    tinygltf::Model m2;
+    std::string err2;
+    std::string warn2;
+    bool ok = ctx2.LoadASCIIFromString(
+        &m2, &err2, &warn2, gltf_small.c_str(),
+        static_cast<unsigned int>(gltf_small.size()), ".");
+    REQUIRE_FALSE(ok);
+    REQUIRE_THAT(err2,
+                 Catch::Contains("Data URI for buffer exceeds maximum allowed"));
+  }
+}
+
+TEST_CASE("max-external-file-size", "[security]") {
+  tinygltf::TinyGLTF ctx;
+  ctx.SetMaxExternalFileSize(16);  // small limit to force rejection.
+
+  const std::string gltf_path = "oversize.gltf";
+  {
+    std::ofstream ofs(gltf_path, std::ios::binary);
+    ofs << R"({"asset":{"version":"2.0"}})" << std::string(64, ' ');
+  }
+
+  tinygltf::Model model;
+  std::string err;
+  std::string warn;
+  bool ok = ctx.LoadASCIIFromFile(&model, &err, &warn, gltf_path);
+  REQUIRE_FALSE(ok);
+  REQUIRE_THAT(err,
+               Catch::Contains("exceeds maximum allowed file size"));
+  std::remove(gltf_path.c_str());
+
+  const std::string glb_path = "oversize.glb";
+  {
+    std::ofstream ofs(glb_path, std::ios::binary);
+    ofs << std::string(32, '\0');
+  }
+
+  err.clear();
+  warn.clear();
+  ok = ctx.LoadBinaryFromFile(&model, &err, &warn, glb_path);
+  REQUIRE_FALSE(ok);
+  REQUIRE_THAT(err,
+               Catch::Contains("exceeds maximum allowed file size"));
+  std::remove(glb_path.c_str());
+}
+
+TEST_CASE("max-size-in-memory", "[security]") {
+  tinygltf::TinyGLTF ctx;
+  ctx.SetMaxExternalFileSize(16);
+
+  // LoadASCIIFromString should reject oversized input.
+  {
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+    std::string large_json(20, ' ');
+    bool ok = ctx.LoadASCIIFromString(
+        &model, &err, &warn, large_json.c_str(),
+        static_cast<unsigned int>(large_json.size()), ".");
+    REQUIRE_FALSE(ok);
+    REQUIRE_THAT(err, Catch::Contains("Input size exceeds maximum"));
+  }
+
+  // LoadBinaryFromMemory should reject oversized input even before parsing.
+  {
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+    std::array<unsigned char, 32> bytes{};
+    // Craft minimal glTF header; size still exceeds limit and should be
+    // rejected early.
+    bytes[0] = 'g'; bytes[1] = 'l'; bytes[2] = 'T'; bytes[3] = 'F';
+    bytes[4] = 2; // version little-endian
+    bool ok = ctx.LoadBinaryFromMemory(&model, &err, &warn, bytes.data(),
+                                       static_cast<unsigned int>(bytes.size()),
+                                       ".");
+    REQUIRE_FALSE(ok);
+    REQUIRE_THAT(err, Catch::Contains("Input size exceeds maximum"));
+  }
+
+  SECTION("GLB length mismatch is rejected in strict mode") {
+    tinygltf::TinyGLTF ctx_strict;
+    ctx_strict.SetParseStrictness(tinygltf::ParseStrictness::Strict);
+
+    // Construct a minimal GLB with length field smaller than actual buffer.
+    std::array<unsigned char, 32> glb{};
+    glb[0] = 'g'; glb[1] = 'l'; glb[2] = 'T'; glb[3] = 'F';
+    glb[4] = 2; // version
+    uint32_t length = 24; // claimed length (smaller than actual buffer size)
+    memcpy(&glb[8], &length, 4);
+    uint32_t json_len = 4;
+    memcpy(&glb[12], &json_len, 4);
+    uint32_t json_fmt = 0x4E4F534A; // "JSON"
+    memcpy(&glb[16], &json_fmt, 4);
+
+    tinygltf::Model model;
+    std::string err;
+    std::string warn;
+    bool ok = ctx_strict.LoadBinaryFromMemory(
+        &model, &err, &warn, glb.data(),
+        static_cast<unsigned int>(glb.size()), ".");
+    REQUIRE_FALSE(ok);
+    REQUIRE_THAT(err,
+                 Catch::Contains("Length field does not match data size"));
+  }
+}
+
 TEST_CASE("serialize-empty-node", "[issue-457]") {
   tinygltf::Model m;
   // Add default constructed node to model
@@ -1199,4 +1389,51 @@ TEST_CASE("inverse-bind-matrices-optional", "[issue-492]") {
 
   REQUIRE(true == ret);
   REQUIRE(err.empty());
-}
+}
+
+bool LoadImageData(tinygltf::Image * /* image */, const int /* image_idx */, std::string * /* err */,
+                   std::string * /* warn */, int /* req_width */, int /* req_height */,
+                   const unsigned char * /* bytes */, int /* size */, void * /*user_data */) {
+    return true;
+}
+
+bool WriteImageData(const std::string * /* basepath */, const std::string * /* filename */,
+                    const tinygltf::Image *image, bool /* embedImages */,
+                    const tinygltf::FsCallbacks * /* fs_cb */, const tinygltf::URICallbacks * /* uri_cb */,
+                    std::string * /* out_uri */, void * user_pointer) {
+    REQUIRE(user_pointer != nullptr);
+    auto counter = static_cast<int*>(user_pointer);
+    *counter = *counter + 1;
+    return true;
+}
+
+TEST_CASE("empty-images-not-written", "[issue-495]") {
+  std::string err;
+  std::string warn;
+  tinygltf::Model model;
+  tinygltf::TinyGLTF ctx;
+
+  ctx.SetImageLoader(LoadImageData, nullptr);
+  bool ok = ctx.LoadASCIIFromFile(&model, &err, &warn, "../models/Cube/Cube.gltf");
+  REQUIRE(ok);
+  REQUIRE(err.empty());
+  REQUIRE(warn.empty());
+
+  CHECK(model.images.size() == 2);
+  for (const auto& image : model.images) {
+    // No data loaded or decoded
+    CHECK(image.image.empty());
+    // The URI is kept
+    CHECK_FALSE(image.uri.empty());
+    // The URI should not be a data URI
+    CHECK(image.uri.find("data:") != 0);
+  }
+
+  // Now write the loaded model
+  int counter = 0;
+  ctx.SetImageWriter(WriteImageData, &counter);
+  ok = ctx.WriteGltfSceneToFile(&model, "issue-495-external.gltf");
+  CHECK(ok);
+  // WriteImageData should be invoked for both images
+  CHECK(counter == 2);
+}