draco: heap-buffer-overflow in KHR_draco_mesh_compression parsing when bufferView byteOffset exceeds buffer size (vendored tinygltf)
Maintainers usually reply within 5 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 75/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- cpp
- Domain
- computer-graphics
Research direction
Read ParseDracoExtension in third_party/tinygltf/tiny_gltf.h around lines 4289–4296, then trace how it builds the buffer slice from byteOffset and byteLength. Check the bounds using the reported 520-byte buffer and byteOffset 10000 case. Done means the malformed glTF is rejected before the Draco decoder reads beyond the buffer.
Written by the indexing model from the issue text.
Description
Root cause: the vendored tinygltf parser's ParseDracoExtension (third_party/tinygltf/tiny_gltf.h, ~lines 4289-4296) builds the Draco buffer slice from a bufferView's byteOffset without validating it against the buffer's byteLength. With byteOffset=10000 on a 520-byte buffer, it constructs a slice claiming 520 bytes starting at data+10000; draco's DecoderBuffer then reads past the real buffer end. DecoderBuffer's own size check passes because it is handed the false size — the fault is in the tinygltf slice construction, the crash surfaces in draco's decoder.
Evidence (local ASan build, KHR_draco_mesh_compression glTF, 1-field JSON change from a valid seed, seed buffer untouched):
- ASan heap-buffer-overflow READ size 5: memcpy -> DecoderBuffer::Decode (src/draco/core/decoder_buffer.h:80) -> PointCloudDecoder::DecodeHeader -> Decoder::DecodeBufferToGeometry -> Decoder::DecodeMeshFromBuffer -> ParseDracoExtension (tiny_gltf.h:4296) -> ParsePrimitive -> ParseMesh.
- Trigger: bufferView byteOffset 10000 with buffers[0].byteLength 520.
Impact: out-of-bounds read / crash (denial of service) in any tool parsing KHR_draco_mesh_compression glTF through this path. Low severity.
Suggested fix: validate byteOffset + byteLength against the buffer size in ParseDracoExtension before building the slice, or update the vendored tinygltf copy.
Note: checked against #1165 — different code path (draco's own decoder, not the tinygltf extension slice).
Reproducer: the minimal 2.2KB glTF trigger is available on request.
- Dominant language
- C++
- Stars
- 7.5k
- Forks
- 1.1k
- Avg merge
- 3d 11h
- Merged PRs (30d)
- 9
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from google/draco
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 5 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 5 days
-
documentation low priority
Difficulty 1/5 Under an hour Newbie friendliness 68/100
Maintainers usually reply within 5 days
-
draco: OOB read/SEGV in glTF animation channel and sampler indices (unchecked indices in AddChannelToAnimation/AddSamplerToAnimation)Possibly taken @Subhan1794 claimed this 13 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 20/100
Maintainers usually reply within 5 days
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
Maintainers usually reply within 5 days
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 3 days
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
SCIInstitute/SCIRun#2909 ·
Maintainers usually reply within 2 days
-
bug libcudf
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 2 days
-
Triage: Needed
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 2 days