3 people d112a0af29 Fix two stack buffer overflows in ADMesh stl_read (unbounded solid name + MW metadata parse) (#15594) ...

Fix two stack buffer overflows in ADMesh stl_read (solid name + MW parse)

Bound the ASCII-STL solid-name fscanf scanset to the buffer size, and bound
the OrcaSlicer-specific "MW" metadata sscanf %s conversions to their buffers:

- fscanf(fp, " solid %[^\n]", solid_name)  -> %255[^\n]   (solid_name[256])
- sscanf(mw_position+3, "%s %s %s", ...)   -> %15s %127s %15s
  (version_str[16], model_id_str[128], country_code_str[16])

Both are reachable by opening a crafted .stl and overwrite saved stack state
(instruction-pointer control on the no-PAC arm64 macOS build). The solid-name
defect is inherited from the shared ADMesh loader (bambulab/BambuStudio#12153);
the MW parse is OrcaSlicer-specific.

Co-authored-by: Kevin Finisterre <kfinisterre@KevinsMacStudio.localdomain>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-09-09 07:39:08 -03:00

..

CMakeLists.txt

Update eigen to v5.0.1 and libigl to v2.6.0. (#11311)

2026-05-12 15:09:13 +08:00

connect.cpp

Refactor folder (#10475)

2025-08-22 20:02:26 +08:00

normals.cpp

Refactor folder (#10475)

2025-08-22 20:02:26 +08:00

shared.cpp

Refactor folder (#10475)

2025-08-22 20:02:26 +08:00

stl_io.cpp

Refactor folder (#10475)

2025-08-22 20:02:26 +08:00

stl.h

Refactor folder (#10475)

2025-08-22 20:02:26 +08:00

stlinit.cpp

Fix two stack buffer overflows in ADMesh stl_read (unbounded solid name + MW metadata parse) (#15594)

2026-09-09 07:39:08 -03:00

util.cpp

Refactor folder (#10475)

2025-08-22 20:02:26 +08:00