Skip to content

Fix out-of-bounds read unpacking sparse accessor values with byteStride#296

Open
SAY-5 wants to merge 1 commit into
jkuhlmann:masterfrom
SAY-5:fix-sparse-unpack-oob
Open

Fix out-of-bounds read unpacking sparse accessor values with byteStride#296
SAY-5 wants to merge 1 commit into
jkuhlmann:masterfrom
SAY-5:fix-sparse-unpack-oob

Conversation

@SAY-5

@SAY-5 SAY-5 commented Jun 9, 2026

Copy link
Copy Markdown

cgltf_accessor_unpack_floats advances through the sparse values buffer view using accessor->stride, but the sparse values are tightly packed, so cgltf_validate only sizes that buffer view as element_size * sparse->count. When the accessor's byteStride is larger than the packed element size, the second pass reads past the end of the values buffer view even though the file passes validation. This walks the sparse values by the packed element size instead, matching what validate checks. Fixes #295.

Signed-off-by: Sai Asish Y <say.apm35@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Heap-buffer-overflow (OOB read) in cgltf_accessor_unpack_floats for sparse accessors

1 participant