Crashes when the number of properties is less than what the header defines

Start at the element-property loop that calls parseNext and inspect tokenSplit and parseNext together. Reproduce the supplied PLY example with fewer values than declared, then verify that the chosen bounds-checking behavior prevents an out-of-bounds access and handles the malformed row safely.

Properties are parsed with a loop that is repeated elem.properties.size() times, which is the number of properties the header says this element should have.

vector<string> tokens = tokenSplit(line);
size_t iTok = 0;
for (size_t iP = 0; iP < elem.properties.size(); iP++) {
  elem.properties[iP]->parseNext(tokens, iTok);
}

However if this element has less properties than the header defines, tokenSplit(line) returns a number of tokens less than elem.properties.size().

Then when we call parseNext, tokens[curEntry] is an out-of-bounds access and we crash when trying to create an istringstream from whatever garbage we read.

virtual void parseNext(const std::vector<std::string>& tokens, size_t& currEntry) override {
  data.emplace_back();
  std::istringstream iss(tokens[currEntry]);
  typename SerializeType<T>::type tmp; // usually the same type as T
  iss >> tmp;
  data.back() = tmp;
  currEntry++;
};

Here is an example file that will cause a crash:

ply
format ascii 1.0
element vertex 1
property float x
property float y
property char z
comment There are 3 properties but we provide only 2!
end_header
3 4 

Possible fixes:

• Verify that the number of tokens matches the expected number of properties
• In parseNext, ensure that currEntry is within tokens.size()
• In parseNext, use tokens.at(currEntry)