Skip to content

Commit 0fc802c

Browse files
Fix TALOS-2020-1212 (tinyobjloader#358)
Co-authored-by: Jacob Beard <jake@minnow.io>
1 parent 45f683c commit 0fc802c

5 files changed

Lines changed: 57 additions & 1 deletion

File tree

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@ build/
44
/python/*.egg-info
55
/python/.eggs
66
/python/tiny_obj_loader.h
7+
/tests/tester
8+
/tests/tester.dSYM
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
vt 0 0
2+
f 1/-1 1/-1 1/-2
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
f -4 -3 -2

‎tests/tester.cc‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -858,6 +858,50 @@ void test_zero_face_idx_value_issue140() {
858858
TEST_CHECK(!err.empty());
859859
}
860860

861+
void test_invalid_relative_vertex_index() {
862+
tinyobj::attrib_t attrib;
863+
std::vector<tinyobj::shape_t> shapes;
864+
std::vector<tinyobj::material_t> materials;
865+
866+
std::string warn;
867+
std::string err;
868+
bool ret =
869+
tinyobj::LoadObj(&attrib, &shapes, &materials, &warn, &err,
870+
"../models/invalid-relative-vertex-index.obj", gMtlBasePath);
871+
872+
if (!warn.empty()) {
873+
std::cout << "WARN: " << warn << std::endl;
874+
}
875+
876+
if (!err.empty()) {
877+
std::cerr << "ERR: " << err << std::endl;
878+
}
879+
TEST_CHECK(false == ret);
880+
TEST_CHECK(!err.empty());
881+
}
882+
883+
void test_invalid_texture_vertex_index() {
884+
tinyobj::attrib_t attrib;
885+
std::vector<tinyobj::shape_t> shapes;
886+
std::vector<tinyobj::material_t> materials;
887+
888+
std::string warn;
889+
std::string err;
890+
bool ret =
891+
tinyobj::LoadObj(&attrib, &shapes, &materials, &warn, &err,
892+
"../models/invalid-relative-texture-vertex-index.obj", gMtlBasePath);
893+
894+
if (!warn.empty()) {
895+
std::cout << "WARN: " << warn << std::endl;
896+
}
897+
898+
if (!err.empty()) {
899+
std::cerr << "ERR: " << err << std::endl;
900+
}
901+
TEST_CHECK(false == ret);
902+
TEST_CHECK(!err.empty());
903+
}
904+
861905
void test_texture_name_whitespace_issue145() {
862906
tinyobj::attrib_t attrib;
863907
std::vector<tinyobj::shape_t> shapes;
@@ -1467,4 +1511,8 @@ TEST_LIST = {
14671511
test_mtl_filename_with_whitespace_issue46},
14681512
{"test_face_missing_issue295",
14691513
test_face_missing_issue295},
1514+
{"test_invalid_relative_vertex_index",
1515+
test_invalid_relative_vertex_index},
1516+
{"test_invalid_texture_vertex_index",
1517+
test_invalid_texture_vertex_index},
14701518
{NULL, NULL}};

‎tiny_obj_loader.h‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -835,6 +835,9 @@ static inline bool fixIndex(int idx, int n, int *ret, bool allow_zero, const war
835835

836836
if (idx < 0) {
837837
(*ret) = n + idx; // negative value = relative
838+
if((*ret) < 0){
839+
return false; // invalid relative index
840+
}
838841
return true;
839842
}
840843

@@ -2782,7 +2785,7 @@ bool LoadObj(attrib_t *attrib, std::vector<shape_t> *shapes,
27822785
static_cast<int>(vn.size() / 3),
27832786
static_cast<int>(vt.size() / 2), &vi, context)) {
27842787
if (err) {
2785-
(*err) += "Failed to parse `f' line (e.g. a zero value for vertex index. Line " +
2788+
(*err) += "Failed to parse `f' line (e.g. a zero value for vertex index or invalid relative vertex index). Line " +
27862789
toString(line_num) + ").\n";
27872790
}
27882791
return false;

0 commit comments

Comments
 (0)