Fix heap buffer overflow in Cycles IES parser

The IES parser in Cycles would lead to heap buffer overflow error
when non-supported or invalid data is provided to it.

The error was caused by the way how stirng is copied to vector
skipping the last null-terminator. Later C-style string utilities
are used for parsing, and they expect the data to be null-terminated.

It is unclear why data needs to be stored as vector: storing it as
string simplifies initialization.

Easiest to reproduce the issue is to use Blender build with address
sanitizer enabled.

Pull Request: https://projects.blender.org/blender/blender/pulls/116752
This commit is contained in:
Sergey Sharybin 2024-01-03 18:00:41 +01:00 committed by Sergey Sharybin
parent 534a1c9ecd
commit d86d86f729
3 changed files with 21 additions and 2 deletions

View File

@ -32,6 +32,7 @@ set(SRC
integrator_tile_test.cpp
render_graph_finalize_test.cpp
util_aligned_malloc_test.cpp
util_ies_test.cpp
util_math_test.cpp
util_md5_test.cpp
util_path_test.cpp

View File

@ -0,0 +1,18 @@
/* SPDX-FileCopyrightText: 2011-2024 Blender Foundation
*
* SPDX-License-Identifier: Apache-2.0 */
#include "testing/testing.h"
#include "util/ies.h"
CCL_NAMESPACE_BEGIN
TEST(util_ies, invalid)
{
IESFile ies_file;
EXPECT_FALSE(ies_file.load("Hello, World!"));
}
CCL_NAMESPACE_END

View File

@ -63,11 +63,11 @@ void IESFile::pack(float *data)
class IESTextParser {
public:
vector<char> text;
string text;
char *data;
bool error;
IESTextParser(const string &str) : text(str.begin(), str.end()), error(false)
IESTextParser(const string &str) : text(str), error(false)
{
std::replace(text.begin(), text.end(), ',', ' ');
data = strstr(&text[0], "\nTILT=");