juli/OrcaSlicer
1
1
Fork 0
mirror of https://github.com/OrcaSlicer/OrcaSlicer.git synced 2026-09-12 11:37:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix two stack buffer overflows in ADMesh stl_read (unbounded solid name + MW metadata parse) (#15594)

Browse Source 
Fix two stack buffer overflows in ADMesh stl_read (solid name + MW parse)

Bound the ASCII-STL solid-name fscanf scanset to the buffer size, and bound
the OrcaSlicer-specific "MW" metadata sscanf %s conversions to their buffers:

- fscanf(fp, " solid %[^\n]", solid_name)  -> %255[^\n]   (solid_name[256])
- sscanf(mw_position+3, "%s %s %s", ...)   -> %15s %127s %15s
  (version_str[16], model_id_str[128], country_code_str[16])

Both are reachable by opening a crafted .stl and overwrite saved stack state
(instruction-pointer control on the no-PAC arm64 macOS build). The solid-name
defect is inherited from the shared ADMesh loader (bambulab/BambuStudio#12153);
the MW parse is OrcaSlicer-specific.

Co-authored-by: Kevin Finisterre <kfinisterre@KevinsMacStudio.localdomain>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
MAVProxyUser
2026-09-09 06:39:08 -04:00
committed by GitHub
parent 8af92214d0
commit d112a0af29
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
deps_src/admesh/stlinit.cpp
View File

@@ -162,7 +162,7 @@ static bool stl_read(stl_file *stl, FILE *fp, int first_facet, bool first, Impor
rewind(fp);
try{
char solid_name[256];
int res_solid = fscanf(fp, " solid %[^\n]", solid_name);
int res_solid = fscanf(fp, " solid %255[^\n]", solid_name);
if (res_solid == 1) {
char* mw_position = strstr(solid_name, "MW");
if (mw_position != NULL) {
@@ -170,7 +170,7 @@ static bool stl_read(stl_file *stl, FILE *fp, int first_facet, bool first, Impor
char version_str[16];
char model_id_str[128];
char country_code_str[16];
int num_values = sscanf(mw_position + 3, "%s %s %s", version_str, model_id_str, country_code_str);
int num_values = sscanf(mw_position + 3, "%15s %127s %15s", version_str, model_id_str, country_code_str);
if (num_values == 3) {
if (strcmp(version_str, "1.0") == 0) {
model_id = model_id_str;