draco: SEGV in KHR_draco_mesh_compression parsing when attribute lookup returns null (vendored tinygltf)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
Research direction
Start with ParseDracoExtension in third_party/tinygltf/tiny_gltf.h around line 4340 and inspect how a failed GetAttributeByUniqueId lookup is handled. Reproduce with the KHR_draco_mesh_compression input using attribute id 999 or -1 under ASan/UBSan. Done means invalid attribute ids are rejected without a crash; the issue says reproducer files are available on request.
Written by the indexing model from the issue text.
Description
Root cause: the vendored tinygltf parser's ParseDracoExtension (third_party/tinygltf/tiny_gltf.h, line 4340) uses the result of mesh->GetAttributeByUniqueId() without a null check, then calls pAttribute->buffer() on it. With an attribute id that does not resolve (e.g. 999 or -1), this is a null-pointer dereference.
Evidence (local ASan+UBSan build, KHR_draco_mesh_compression glTF, minimal JSON changes from a valid seed):
- UBSan: member call / member access on null pointer of type PointAttribute (tiny_gltf.h:4334, 4340; point_attribute.h:62; geometry_attribute.h:273).
- ASan: SEGV on unknown address 0x18, READ: ParseDracoExtension (tiny_gltf.h:4340) -> ParsePrimitive (4435) -> ParseMesh (4456).
- Trigger: attribute id 999 or -1 in the extension JSON. Seven other fuzz inputs hit the identical signature — one root cause, not nine bugs.
Impact: crash (denial of service) in any tool parsing KHR_draco_mesh_compression glTF through this path. Low severity. The fault is in the vendored tinygltf parser, reached via draco's glTF parsing path.
Suggested fix: null-check the attribute lookup result in ParseDracoExtension and reject the primitive, or update the vendored tinygltf copy.
Reproducer: the minimal glTF triggers are available on request.
- Dominant language
- C++
- Stars
- 7.5k
- Forks
- 1.1k
- Avg merge
- 1d 59m
- Merged PRs (30d)
- 4
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from google/draco
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
documentation low priority
Difficulty 1/5 Under an hour Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
draco: OOB read/SEGV in glTF animation channel and sampler indices (unchecked indices in AddChannelToAnimation/AddSamplerToAnimation)Possibly taken @Subhan1794 claimed this 14 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 20/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
Maintainers usually reply within 1 day
Similar issues
-
libc++ test-suite
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
llvm/llvm-project#239851 ·
Maintainers usually reply within 1 day
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
bug :bug:
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
comp-documentation
Difficulty 1/5 Under an hour Newbie friendliness 84/100
ClickHouse/ClickHouse#129829 ·
Maintainers usually reply within 1 day
-
feature request Python
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 2 days