diff --git a/0001-ColladaParser-check-values-length-5462.patch b/0001-ColladaParser-check-values-length-5462.patch new file mode 100644 index 0000000..3ab4ae8 --- /dev/null +++ b/0001-ColladaParser-check-values-length-5462.patch @@ -0,0 +1,295 @@ +From 4b9f46dbda5128d6d538d185eb69ad6a7b4b99ff Mon Sep 17 00:00:00 2001 +From: Adam Mizerski +Date: Thu, 15 Feb 2024 13:07:00 +0100 +Subject: [PATCH] ColladaParser: check values length (#5462) + +* ColladaParser: check values length + +fixes: #4286 + +* Refactor calculation of size for data + +--------- + +Co-authored-by: Kim Kulling +--- + code/AssetLib/Collada/ColladaParser.cpp | 10 +- + .../invalid/box_nested_animation_4286.dae | 196 ++++++++++++++++++ + test/models/invalid/readme.txt | 3 + + test/unit/utColladaImportExport.cpp | 8 + + 4 files changed, 216 insertions(+), 1 deletion(-) + create mode 100644 test/models/invalid/box_nested_animation_4286.dae + +diff --git a/code/AssetLib/Collada/ColladaParser.cpp b/code/AssetLib/Collada/ColladaParser.cpp +index ee7a395d9..c5163fe39 100644 +--- a/code/AssetLib/Collada/ColladaParser.cpp ++++ b/code/AssetLib/Collada/ColladaParser.cpp +@@ -3,7 +3,7 @@ + Open Asset Import Library (assimp) + --------------------------------------------------------------------------- + +-Copyright (c) 2006-2022, assimp team ++Copyright (c) 2006-2024, assimp team + + All rights reserved. + +@@ -1786,6 +1786,10 @@ size_t ColladaParser::ReadPrimitives(XmlNode &node, Mesh &pMesh, std::vectormData) { + acc->mData = &ResolveLibraryReference(mDataLibrary, acc->mSource); ++ const size_t dataSize = acc->mOffset + acc->mCount * acc->mStride; ++ if (dataSize > acc->mData->mValues.size()) { ++ throw DeadlyImportError("Not enough data for accessor"); ++ } + } + } + // and the same for the per-index channels +@@ -1810,6 +1814,10 @@ size_t ColladaParser::ReadPrimitives(XmlNode &node, Mesh &pMesh, std::vectormData) { + acc->mData = &ResolveLibraryReference(mDataLibrary, acc->mSource); ++ const size_t dataSize = acc->mOffset + acc->mCount * acc->mStride; ++ if (dataSize > acc->mData->mValues.size()) { ++ throw DeadlyImportError("Not enough data for accessor"); ++ } + } + } + +diff --git a/test/models/invalid/box_nested_animation_4286.dae b/test/models/invalid/box_nested_animation_4286.dae +new file mode 100644 +index 000000000..2def61d20 +--- /dev/null ++++ b/test/models/invalid/box_nested_animation_4286.dae +@@ -0,0 +1,196 @@ ++ ++ ++ ++ ++ Blender User ++ Blender 2.80.40 commit date:2019-01-07, commit time:23:37, hash:91a155833e59 ++ ++ 2019-01-08T17:44:11 ++ 2019-01-08T17:44:11 ++ ++ Z_UP ++ ++ ++ ++ ++ ++ ++ ++ 0.8 0.8 0.8 1 ++ ++ ++ 0 0.5 0 1 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ 1 1 1 1 1 -1 1 -1 1 1 -1 -1 -1 1 1 -1 1 -1 -1 -1 1 -1 -1 -1 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ 0 0 1 0 -1 0 -1 0 0 0 0 -1 1 0 0 0 1 0 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ 0.625 0 0.375 0.25 0.375 0 0.625 0.25 0.375 0.5 0.375 0.25 0.625 0.5 0.375 0.75 0.375 0.5 0.625 0.75 0.375 1 0.375 0.75 0.375 0.5 0.125 0.75 0.125 0.5 0.875 0.5 0.625 0.75 0.625 0.5 0.625 0 0.625 0.25 0.375 0.25 0.625 0.25 0.625 0.5 0.375 0.5 0.625 0.5 0.625 0.75 0.375 0.75 0.625 0.75 0.625 1 0.375 1 0.375 0.5 0.375 0.75 0.125 0.75 0.875 0.5 0.875 0.75 0.625 0.75 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ 3 3 3 3 3 3 3 3 3 3 3 3 ++

4 0 0 2 0 1 0 0 2 2 1 3 7 1 4 3 1 5 6 2 6 5 2 7 7 2 8 1 3 9 7 3 10 5 3 11 0 4 12 3 4 13 1 4 14 4 5 15 1 5 16 5 5 17 4 0 18 6 0 19 2 0 20 2 1 21 6 1 22 7 1 23 6 2 24 4 2 25 5 2 26 1 3 27 3 3 28 7 3 29 0 4 30 2 4 31 3 4 32 4 5 33 0 5 34 1 5 35

++ ++ ++ ++ ++ ++ ++ ++ 1 0 0 -1 0 1 0 1 0 0 1 1 0 0 0 1 ++ ++ Bone ++ ++ ++ ++ ++ ++ ++ ++ 0.7886752 0.2113248 0.5773504 -0.5773504 -0.5773503 0.5773503 0.5773503 1.154701 -0.2113249 -0.7886752 0.5773503 -0.5773502 0 0 0 1 ++ ++ ++ ++ ++ ++ ++ ++ 1 1 1 1 1 1 1 1 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ 1 1 1 1 1 1 1 1 ++ 0 0 0 1 0 2 0 3 0 4 0 5 0 6 0 7 ++ ++ ++ ++ ++ ++ ++ ++ ++ 0.04166662 0.08333331 0.125 0.1666666 0.2083333 0.25 0.2916666 0.3333333 0.375 0.4166666 0.4583333 0.5 0.5416667 0.5833333 0.625 0.6666667 0.7083333 0.75 0.7916667 0.8333333 0.875 0.9166667 0.9583333 1 1.041667 1.083333 1.125 1.166667 1.208333 1.25 1.291667 1.333333 1.375 1.416667 1.458333 1.5 1.541667 1.583333 1.625 1.666667 ++ ++ ++ ++ ++ ++ ++ ++ 1 0 0 1 0 1 0 -1 0 0 1 0 0 0 0 1 0.9999878 3.10816e-5 0.004935208 1 0 0.9999802 -0.006297799 -1 -0.004935306 0.006297722 0.999968 0 0 0 0 1 0.999819 4.61727e-4 0.01901668 1 0 0.9997054 -0.02427293 -1 -0.01902229 0.02426853 0.9995245 0 0 0 0 1 0.9991519 0.002163141 0.04111904 1 0 0.9986191 -0.05253414 -1 -0.04117589 0.05248959 0.9977722 0 0 0 0 1 0.9975264 0.006301912 0.07000974 1 0 0.9959731 -0.08965231 -1 -0.0702928 0.08943056 0.9935095 0 0 0 0 1 0.9944467 0.01411698 0.1042901 1 0 0.9909625 -0.1341392 -1 -0.1052413 0.1333943 0.9854594 0 0 0 0 1 0.9894527 0.02671701 0.1423712 1 0 0.9828442 -0.184438 -1 -0.1448563 0.1824927 0.9724778 0 0 0 0 1 0.9821799 0.04490547 0.1825 1 0 0.9710366 -0.2389307 -1 -0.1879434 0.234673 0.9537326 0 0 0 0 1 0.9724072 0.06904543 0.2228386 1 0 0.9551992 -0.2959637 -1 -0.2332902 0.2877972 0.9288425 0 0 0 0 1 0.9600915 0.09897761 0.261587 1 0 0.9352878 -0.3538882 -1 -0.2796861 0.339765 0.8979618 0 0 0 0 1 0.9453882 0.1340003 0.2971281 1 0 0.9115852 -0.4111113 -1 -0.3259466 0.3886598 0.8618018 0 0 0 0 1 0.9286572 0.1729132 0.328172 1 0 0.8847058 -0.4661497 -1 -0.3709391 0.4328933 0.8215885 0 0 0 0 1 0.9104556 0.2141147 0.3538722 1 0 0.8555763 -0.5176768 -1 -0.4136069 0.4713217 0.7789642 0 0 0 0 1 0.8915175 0.2557371 0.3738919 1 0 0.8253933 -0.5645581 -1 -0.4529863 0.5033134 0.7358525 0 0 0 0 1 0.8727233 0.2957927 0.388408 1 0 0.7955672 -0.6058654 -1 -0.4882152 0.5287529 0.6943099 0 0 0 0 1 0.8550603 0.332307 0.3980502 1 0 0.7676533 -0.6408653 -1 -0.5185286 0.5479785 0.6563899 0 0 0 0 1 0.8395769 0.3634188 0.4037789 1 0 0.7432778 -0.6689829 -1 -0.5432408 0.5616626 0.6240388 0 0 0 0 1 0.8273312 0.3874339 0.4067161 1 0 0.7240622 -0.6897347 -1 -0.5617144 0.5706391 0.5990393 0 0 0 0 1 0.8193359 0.4028329 0.4079393 1 0 0.7115462 -0.7026393 -1 -0.5733138 0.5756976 0.5829953 0 0 0 0 1 0.8164964 0.4082482 0.4082486 1 7.75722e-8 0.707107 -0.7071065 -1 -0.5773504 0.57735 0.5773503 0 0 0 0 1 0.8190646 0.4033515 0.4079717 1 7.78161e-8 0.7111219 -0.7030687 -1 -0.5737014 0.5758587 0.5824547 0 0 0 0 1 0.8263245 0.3893851 0.4068995 1 7.85059e-8 0.7224849 -0.6913868 -1 -0.5631944 0.5713098 0.5970069 0 0 0 0 1 0.8375081 0.3675125 0.4043696 1 7.95684e-8 0.7400277 -0.6725764 -1 -0.5464249 0.5632883 0.6197791 0 0 0 0 1 0.8517552 0.3390183 0.3994742 1 8.0922e-8 0.7624427 -0.6470557 -1 -0.5239399 0.5511332 0.6494145 0 0 0 0 1 0.8681612 0.3053284 0.3912425 1 8.24806e-8 0.7883466 -0.6152314 -1 -0.4962822 0.5341201 0.6844119 0 0 0 0 1 0.8858209 0.2680094 0.3788038 1 8.41584e-8 0.8163394 -0.5775725 -1 -0.4640273 0.5116258 0.7231305 0 0 0 0 1 0.9038687 0.2287352 0.3615268 1 8.58731e-8 0.8450637 -0.5346656 -1 -0.42781 0.4832675 0.7638266 0 0 0 0 1 0.9215156 0.1892192 0.339124 1 8.75496e-8 0.8732626 -0.4872499 -1 -0.3883413 0.4490085 0.8047251 0 0 0 0 1 0.9380813 0.1511175 0.3117163 1 8.91235e-8 0.899834 -0.4362323 -1 -0.3464153 0.4092214 0.8441175 0 0 0 0 1 0.9530206 0.1159168 0.2798482 1 9.05428e-8 0.9238796 -0.3826832 -1 -0.3029055 0.3647051 0.8804763 0 0 0 0 1 0.965943 0.08482374 0.2444564 1 9.17705e-8 0.9447417 -0.3278156 -1 -0.2587547 0.3166512 0.9125667 0 0 0 0 1 0.9766233 0.05867312 0.2067956 1 9.27852e-8 0.9620277 -0.2729518 -1 -0.2149581 0.2665711 0.9395387 0 0 0 0 1 0.9850019 0.03787052 0.1683363 1 9.35812e-8 0.975616 -0.2194843 -1 -0.1725436 0.2161924 0.9609836 0 0 0 0 1 0.991176 0.02237916 0.1306496 1 9.41678e-8 0.9856446 -0.1688333 -1 -0.1325524 0.1673435 0.9769473 0 0 0 0 1 0.9953793 0.01175384 0.09529842 1 9.45671e-8 0.9924796 -0.1224106 -1 -0.09602053 0.121845 0.9878936 0 0 0 0 1 0.997952 0.005218936 0.06375288 1 9.48115e-8 0.996666 -0.08159051 -1 -0.06396614 0.08142342 0.9946249 0 0 0 0 1 0.9993011 0.001782816 0.03733916 1 9.49397e-8 0.998862 -0.04769476 -1 -0.0373817 0.04766143 0.9981638 0 0 0 0 1 0.9998515 3.78837e-4 0.01722835 1 9.4992e-8 0.9997582 -0.02198936 -1 -0.01723252 0.0219861 0.9996098 0 0 0 0 1 0.99999 2.53135e-5 0.004462156 1 9.50052e-8 0.9999838 -0.00569412 -1 -0.004462227 0.005694063 0.9999738 0 0 0 0 1 1 0 0 2 0 1 0 -1 0 0 1 0 0 0 0 1 ++ ++ ++ ++ ++ ++ ++ ++ LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR LINEAR ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ 1 0 0 1 0 1 0 -1 0 0 1 0 0 0 0 1 ++ ++ 0.7886751 -0.5773503 -0.211325 0 0.2113248 0.5773503 -0.7886751 0 0.5773503 0.5773503 0.5773502 0 0 0 0 1 ++ ++ ++ 0 ++ -0.5235989 ++ -2 ++ 2 ++ 2 ++ ++ ++ ++ ++ 0 0 0 ++ 0 0 1 0 ++ 0 1 0 0 ++ 1 0 0 0 ++ 1 1 1 ++ ++ #Armature_Bone ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/test/models/invalid/readme.txt b/test/models/invalid/readme.txt +index 6ad8b4380..ad144ca36 100644 +--- a/test/models/invalid/readme.txt ++++ b/test/models/invalid/readme.txt +@@ -18,6 +18,9 @@ crash. + FILES + ********************************************************* + ++box_nested_animation_4286.dae - This was reported as GH#4286. ++ The "count" parameter in "Cube-mesh-positions-array" is too small. ++ + OutOfMemory.off - the number of faces is invalid. There won't be + enough memory so std::vector::reserve() will most likely fail. + The exception should be caught in Importer.cpp. +diff --git a/test/unit/utColladaImportExport.cpp b/test/unit/utColladaImportExport.cpp +index e2842732e..52a927b12 100644 +--- a/test/unit/utColladaImportExport.cpp ++++ b/test/unit/utColladaImportExport.cpp +@@ -357,6 +357,14 @@ TEST_F(utColladaImportExport, exporterUniqueIdsTest) { + ImportAsNames(outFileNamed, scene); + } + ++// This file is invalid, we just want to ensure that the importer is not crashing ++// This was reported as GH#4286. The "count" parameter in "Cube-mesh-positions-array" is too small. ++TEST_F(utColladaImportExport, parseInvalid4286) { ++ Assimp::Importer importer; ++ const aiScene *scene = importer.ReadFile(ASSIMP_TEST_MODELS_DIR "/invalid/box_nested_animation_4286.dae", 0); ++ EXPECT_EQ(nullptr, scene); ++} ++ + #endif + + class utColladaZaeImportExport : public AbstractImportExportBase { +-- +2.43.0 + diff --git a/0001-Don-t-build-the-collada-importer-exporter-tests.patch b/0001-Don-t-build-the-collada-importer-exporter-tests.patch deleted file mode 100644 index d20979c..0000000 --- a/0001-Don-t-build-the-collada-importer-exporter-tests.patch +++ /dev/null @@ -1,27 +0,0 @@ -From a0628aa4b175b6764ac6ea481a5e65f91cd118fa Mon Sep 17 00:00:00 2001 -From: Christophe Marin -Date: Wed, 4 Oct 2023 16:23:17 +0200 -Subject: [PATCH] Don't build the collada importer/exporter tests - ---- - test/CMakeLists.txt | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt -index afe487411..d8f044501 100644 ---- a/test/CMakeLists.txt -+++ b/test/CMakeLists.txt -@@ -141,8 +141,8 @@ SET( IMPORTERS - unit/utBlendImportMaterials.cpp - unit/utBlenderWork.cpp - unit/utBVHImportExport.cpp -- unit/utColladaExport.cpp -- unit/utColladaImportExport.cpp -+ # unit/utColladaExport.cpp -+ # unit/utColladaImportExport.cpp - unit/utCSMImportExport.cpp - unit/utB3DImportExport.cpp - #unit/utM3DImportExport.cpp --- -2.42.0 - diff --git a/assimp.changes b/assimp.changes index 45be32f..95c1a47 100644 --- a/assimp.changes +++ b/assimp.changes @@ -1,3 +1,12 @@ +------------------------------------------------------------------- +Mon Feb 12 23:13:07 UTC 2024 - Adam Mizerski + +- Reenable the Collada parser. +- Removed patch 0001-Don-t-build-the-collada-importer-exporter-tests.patch +- Add patch (boo#1207377, CVE-2022-45748) + * 0001-ColladaParser-check-values-length-5462.patch +- Improved tests filtering + ------------------------------------------------------------------- Wed Oct 4 14:14:08 UTC 2023 - Christophe Marin diff --git a/assimp.spec b/assimp.spec index cb7fe00..6ccfd9f 100644 --- a/assimp.spec +++ b/assimp.spec @@ -1,7 +1,7 @@ # # spec file for package assimp # -# Copyright (c) 2023 SUSE LLC +# Copyright (c) 2024 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -25,8 +25,8 @@ License: BSD-3-Clause AND MIT Group: Development/Libraries/C and C++ URL: https://www.assimp.org/ Source0: %{name}-%{version}.tar.xz -# PATCH-FIX-OPENSUSE -Patch0: 0001-Don-t-build-the-collada-importer-exporter-tests.patch +# PATCH-FIX-UPSTREAM +Patch0: 0001-ColladaParser-check-values-length-5462.patch BuildRequires: cmake BuildRequires: dos2unix BuildRequires: gcc-c++ @@ -76,9 +76,7 @@ engine-specific format for easy and fast every-day-loading. -DASSIMP_IGNORE_GIT_HASH=ON \ -DASSIMP_BUILD_ZLIB=OFF \ -DASSIMP_WARNINGS_AS_ERRORS=OFF \ - -DASSIMP_BUILD_ASSIMP_TOOLS=ON \ - -DASSIMP_BUILD_COLLADA_IMPORTER=OFF \ - -DASSIMP_BUILD_COLLADA_EXPORTER=OFF + -DASSIMP_BUILD_ASSIMP_TOOLS=ON %cmake_build @@ -89,10 +87,44 @@ find %{buildroot} -type f -name "*.la" -delete -print %check pushd build -# utIssues.OpacityBugWhenExporting_727 test fails +gtest_filter="-" + # utVersion.aiGetVersionRevisionTest passes with git builds only +gtest_filter="${gtest_filter}:utVersion.aiGetVersionRevisionTest" + # the models-nonbsd are not in the tarball, tests depending on it are also excluded -./bin/unit --gtest_filter="-utIssues.OpacityBugWhenExporting_727:utVersion.aiGetVersionRevisionTest:ut3DImportExport*:ut3DSImportExport*:utMD2Importer*:utMD5Importer*:utBlenderImporter*:utQ3BSPImportExport*:utXImporter.importDwarf:utDXFImporterExporter.importRifle:utPMXImporter.importTest" +gtest_filter="${gtest_filter}:ut3DImportExport.importMarRifle" +gtest_filter="${gtest_filter}:ut3DImportExport.importMarRifleA" +gtest_filter="${gtest_filter}:ut3DImportExport.importMarRifleD" +gtest_filter="${gtest_filter}:ut3DSImportExport.importCartWheel" +gtest_filter="${gtest_filter}:ut3DSImportExport.importGranate" +gtest_filter="${gtest_filter}:ut3DSImportExport.importJeep1" +gtest_filter="${gtest_filter}:ut3DSImportExport.importMarRifle" +gtest_filter="${gtest_filter}:ut3DSImportExport.importMp5Sil" +gtest_filter="${gtest_filter}:ut3DSImportExport.importPyramob" +gtest_filter="${gtest_filter}:utBlenderImporter.importBob" +gtest_filter="${gtest_filter}:utBlenderImporter.importFleurOptonl" +gtest_filter="${gtest_filter}:utDXFImporterExporter.importRifle" +gtest_filter="${gtest_filter}:utMD2Importer.importDolphin" +gtest_filter="${gtest_filter}:utMD2Importer.importFlag" +gtest_filter="${gtest_filter}:utMD2Importer.importHorse" +gtest_filter="${gtest_filter}:utMD5Importer.importBoarMan" +gtest_filter="${gtest_filter}:utMD5Importer.importBob" +gtest_filter="${gtest_filter}:utPMXImporter.importTest" +gtest_filter="${gtest_filter}:utQ3BSPImportExport.importerTest" +gtest_filter="${gtest_filter}:utXImporter.importDwarf" + +%ifnarch x86_64 +# tests fail, because they assume you can compare floats +# See https://github.com/assimp/assimp/issues/4438 +gtest_filter="${gtest_filter}:AssimpAPITest_aiMatrix3x3.*" +gtest_filter="${gtest_filter}:AssimpAPITest_aiMatrix4x4.*" +gtest_filter="${gtest_filter}:AssimpAPITest_aiQuaternion.*" +gtest_filter="${gtest_filter}:AssimpAPITest_aiVector2D.*" +gtest_filter="${gtest_filter}:AssimpAPITest_aiVector3D.*" +%endif + +./bin/unit --gtest_filter="${gtest_filter}" popd %ldconfig_scriptlets -n lib%{name}%{sover}