From d112a0af290671599490678ef2a5cf7601209a16 Mon Sep 17 00:00:00 2001 From: MAVProxyUser Date: Wed, 9 Sep 2026 06:39:08 -0400 Subject: [PATCH] Fix two stack buffer overflows in ADMesh stl_read (unbounded solid name + MW metadata parse) (#15594) Fix two stack buffer overflows in ADMesh stl_read (solid name + MW parse) Bound the ASCII-STL solid-name fscanf scanset to the buffer size, and bound the OrcaSlicer-specific "MW" metadata sscanf %s conversions to their buffers: - fscanf(fp, " solid %[^\n]", solid_name) -> %255[^\n] (solid_name[256]) - sscanf(mw_position+3, "%s %s %s", ...) -> %15s %127s %15s (version_str[16], model_id_str[128], country_code_str[16]) Both are reachable by opening a crafted .stl and overwrite saved stack state (instruction-pointer control on the no-PAC arm64 macOS build). The solid-name defect is inherited from the shared ADMesh loader (bambulab/BambuStudio#12153); the MW parse is OrcaSlicer-specific. Co-authored-by: Kevin Finisterre Co-authored-by: Claude Opus 4.8 --- deps_src/admesh/stlinit.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/deps_src/admesh/stlinit.cpp b/deps_src/admesh/stlinit.cpp index a69bd5497a..9d44cdf266 100644 --- a/deps_src/admesh/stlinit.cpp +++ b/deps_src/admesh/stlinit.cpp @@ -162,7 +162,7 @@ static bool stl_read(stl_file *stl, FILE *fp, int first_facet, bool first, Impor rewind(fp); try{ char solid_name[256]; - int res_solid = fscanf(fp, " solid %[^\n]", solid_name); + int res_solid = fscanf(fp, " solid %255[^\n]", solid_name); if (res_solid == 1) { char* mw_position = strstr(solid_name, "MW"); if (mw_position != NULL) { @@ -170,7 +170,7 @@ static bool stl_read(stl_file *stl, FILE *fp, int first_facet, bool first, Impor char version_str[16]; char model_id_str[128]; char country_code_str[16]; - int num_values = sscanf(mw_position + 3, "%s %s %s", version_str, model_id_str, country_code_str); + int num_values = sscanf(mw_position + 3, "%15s %127s %15s", version_str, model_id_str, country_code_str); if (num_values == 3) { if (strcmp(version_str, "1.0") == 0) { model_id = model_id_str;