Fix conditional check in SkipSpaces function to prevent out-of-bound access
#5770
Conversation
…access. The `SkipSpaces` function's condition was updated to ensure that the pointer check `in != end` is evaluated before dereferencing the pointer. This change prevents potential out-of-bound access when the input pointer reaches the end.
include/assimp/ParsingUtils.h
Outdated
| @@ -103,7 +103,7 @@ AI_FORCE_INLINE bool IsSpaceOrNewLine(char_t in) { | |||
| // --------------------------------------------------------------------------------- | |||
| template <class char_t> | |||
| AI_FORCE_INLINE bool SkipSpaces(const char_t *in, const char_t **out, const char_t *end) { | |||
| while ((*in == (char_t)' ' || *in == (char_t)'\t') && in != end) { | |||
| while (in >= end && (*in == (char_t)' ' || *in == (char_t)'\t')) { | |||
There was a problem hiding this comment.
Should this be in < end?
This condition seems like it'll change the behavior of the loop.
There was a problem hiding this comment.
Sure, have updated and added more similar changes
|
Do you have a testcase for validation? It would be really great to test this in a proper way. Let me know if you cannot generate one. |
|
I do not have testcases |
|
Looks like it hit an infinite loop. It timed out after 6 hours. The timeout could be reduced to avoid wasting CPU time. |
|
I believe we may have found a new bug. I made the following change to the code: template <class char_t>
AI_FORCE_INLINE bool SkipSpaces(const char_t *in, const char_t **out, const char_t *end) {
if (in > end) {
return false; // gdb stops here
}
while (in < end && (*in == (char_t)' ' || *in == (char_t)'\t')) {
++in;
}After running |
|
|
@cla7aye15I4nd Please resolve conflicts so PR remains viable |
Description:
This PR resolves a potential out-of-bound access issue in the
SkipSpacesfunction within theParsingUtils.hfile. Previously, the condition that checked for whitespace (' 'or'\t') was evaluated before verifying whether the pointerinhad reached the end. This could lead to dereferencing the pointer when it is already at the boundary, resulting in undefined behavior.The update reorders the condition so that the boundary check
in != endis evaluated before accessing the value of*in. This ensures the function operates safely when processing input up to the boundary.Changes:
SkipSpacesfunction to check forin != endbefore dereferencing*in.