draco: OOB read/SEGV in KHR_draco_mesh_compression parsing when bufferView index is out of range (vendored tinygltf)
Maintainers usually reply within 5 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 75/100
Research direction
Start in third_party/tinygltf/tiny_gltf.h at ParseDracoExtension around line 4282, where the issue identifies an unchecked bufferView index. Review the reported ASan cases for indices 999 and -1, then add range validation and reject out-of-range values. Done means both malformed inputs are rejected without the reported out-of-bounds reads or crash.
Written by the indexing model from the issue text.
Description
Root cause: the vendored tinygltf parser's ParseDracoExtension (third_party/tinygltf/tiny_gltf.h, line 4282) indexes model->bufferViews[bufferView] with no range check on the attacker-controlled bufferView index. One missing check, two manifestations:
- bufferView 999: SEGV reading view.buffer (line 4283).
- bufferView -1: heap-buffer-overflow READ size 1 reading view.dracoDecoded (line 4285).
Evidence (local ASan build, KHR_draco_mesh_compression glTF, minimal JSON changes from a valid seed):
- J_bv999 (bufferView:999): ASan SEGV in ParseDracoExtension.
- J_bv_neg1 (bufferView:-1): ASan heap-buffer-overflow READ size 1 in ParseDracoExtension.
Impact: crash (denial of service) in any tool parsing KHR_draco_mesh_compression glTF through this path. Low severity. The fault is in the vendored tinygltf parser, reached via draco's glTF parsing path.
Note on related work: this is distinct from #1247, which validates bufferView/buffer indices in draco's own decoder (src/draco/io/gltf_decoder.cc and tiny_gltf_utils.h) — #1247 does not touch the vendored tinygltf ParseDracoExtension, so this path is still unguarded. It is also distinct from #1257 (byteOffset validation in the same function, different check).
Suggested fix: range-check the bufferView index in ParseDracoExtension and reject out-of-range values, or update the vendored tinygltf copy.
Reproducer: the minimal glTF triggers are available on request.
- Dominant language
- C++
- Stars
- 7.5k
- Forks
- 1.1k
- Avg merge
- 3d 11h
- Merged PRs (30d)
- 9
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from google/draco
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 5 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 5 days
-
documentation low priority
Difficulty 1/5 Under an hour Newbie friendliness 68/100
Maintainers usually reply within 5 days
-
draco: OOB read/SEGV in glTF animation channel and sampler indices (unchecked indices in AddChannelToAnimation/AddSamplerToAnimation)Possibly taken @Subhan1794 claimed this 13 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 20/100
Maintainers usually reply within 5 days
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
Maintainers usually reply within 5 days
Similar issues
-
Linux npm packaging leaves workspace files that block subsequent CI checkoutPossibly taken @Spockkk0225 claimed this today. Openci
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
alibaba/neug#1195 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 3 days
-
QA/No release-notes/exclude tests tests/missing-coverage tests/test-quality
Difficulty 2/5 1-3 hours Newbie friendliness 71/100
brave/brave-browser#61019 ·
Maintainers usually reply within 1 day
-
? - Needs Triage bug CUTLASS C++
Difficulty 1/5 Under an hour Newbie friendliness 88/100
Maintainers usually reply within 4 days