Skip to content

Crashes when the number of properties is less than what the header defines #49

Description

@caleb-krause

Properties are parsed with a loop that is repeated elem.properties.size() times, which is the number of properties the header says this element should have.

vector<string> tokens = tokenSplit(line);
size_t iTok = 0;
for (size_t iP = 0; iP < elem.properties.size(); iP++) {
  elem.properties[iP]->parseNext(tokens, iTok);
}

However if this element has less properties than the header defines, tokenSplit(line) returns a number of tokens less than elem.properties.size().

Then when we call parseNext, tokens[curEntry] is an out-of-bounds access and we crash when trying to create an istringstream from whatever garbage we read.

virtual void parseNext(const std::vector<std::string>& tokens, size_t& currEntry) override {
  data.emplace_back();
  std::istringstream iss(tokens[currEntry]);
  typename SerializeType<T>::type tmp; // usually the same type as T
  iss >> tmp;
  data.back() = tmp;
  currEntry++;
};

Here is an example file that will cause a crash:

ply
format ascii 1.0
element vertex 1
property float x
property float y
property char z
comment There are 3 properties but we provide only 2!
end_header
3 4 

Possible fixes:

  • Verify that the number of tokens matches the expected number of properties
  • In parseNext, ensure that currEntry is within tokens.size()
  • In parseNext, use tokens.at(currEntry)

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions