gltfio: 在 constrainMaterial 和 processShaderString 中通过未校正的 glTF texCoord 索引访问 UvMap 超出范围

作者: destro4evr-rgb创建于 2026年7月13日更新于 2026年8月10日

标签gltfsecurity

Root cause - AssetLoader.cpp lines 1427, 1437–1447, 1455–1456:

cpp

MaterialKey matkey {
    .baseColorUV            = (uint8_t) baseColorTexture->texcoord,
    .normalUV               = (uint8_t) inputMat->normal_texture.texcoord,
    .emissiveUV             = (uint8_t) inputMat->emissive_texture.texcoord,
    .aoUV                   = (uint8_t) inputMat->occlusion_texture.texcoord,
    .transmissionUV         = (uint8_t) trConfig.transmission_texture.texcoord,
    .sheenColorUV           = (uint8_t) shConfig.sheen_color_texture.texcoord,
    .sheenRoughnessUV       = (uint8_t) shConfig.sheen_roughness_texture.texcoord,
    .volumeThicknessUV      = (uint8_t) vlConfig.thickness_texture.texcoord,
    .specularTextureUV      = (uint8_t) spConfig.specular_texture.texcoord,
    .specularColorTextureUV = (uint8_t) spConfig.specular_color_texture.texcoord,
    // metallicRoughnessUV at line 1473, clearCoatUV/clearCoatRoughnessUV/clearCoatNormalUV at 1429-1433
};

cgltf_int texcoord is a plain int. cgltf_validate does not validate material texture texcoord values against any range. The cast to uint8_t silently truncates; values in [8, 255] are stored verbatim.

内容来源: google/filament

查看 GitHub 原文在 GitHub 查看讨论