Repository navigation
draco: glTF decoder does not enforce accessor data within its bufferView (cross-view reads in CopyDataAs*) #1260
Description
Root cause: the CopyDataAs* variants (CopyDataAsUint32, the CopyDataAs overloads, and CopyDataAsFloatImpl in tiny_gltf_utils.h) check byte_stride * count against the BUFFER end, never against bufferView.byteLength. So an accessor whose declared view is shorter than its count silently consumes the next view's bytes in the same buffer. CopyDataFromBufferView (gltf_decoder.cc:392, byte-range check at :410) shows the correct pattern, but it is used only by structural-metadata property tables — not by any attribute, animation, or skin path.
Value proofs (local ASan build; all files decode SUCCESSFULLY where a view-respecting decoder must reject them; zero sanitizer reports — this is a correctness/validation gap, NOT memory unsafety, and is not presented as heap OOB):
- TEXCOORD_0: view 8 bytes (one VEC2 float), count 3 (needs 24 bytes) — decoded UVs are identical to an honest 24-byte control file (neighbor view's UVs stolen).
- Animation: times view 4 bytes (one float), count 2 — decoded times [0, 10] (10 stolen from the neighbor view); translations view 12 bytes (one VEC3), count 2 — second VEC3 stolen from the neighbor view.
- Skin inverseBindMatrices: view 64 bytes (one MAT4), count 2 (needs 128 bytes) — second matrix is exactly the neighbor view's floats 100..115.
- The same shape was previously shown for POSITION and indices.
Impact: malformed glTF silently produces wrong geometry, animation, and skinning instead of being rejected. Low severity (correctness/validation).
Suggested fix: enforce accessor.byteOffset + byte_stride * count <= bufferView.byteLength in CopyDataAsUint32, all CopyDataAs overloads, and CopyDataAsFloatImpl — one fix family closes all consumers together.
Note on related work: distinct from #1247 (index upper-bound validation in draco's own decoder, not byteLength enforcement) and from the tinygltf KHR parsing issues (#1257/#1258/#1259, different parser and path).
Reproducer: the multi-view glTF triggers are available on request.
Activity