Assimp HL1MDLLoader Heap Buffer Overflow Vulnerability Analysis and PoC

Vulnerability Overview Vulnerability Name: Heap Buffer Overflow in Assimp HL1MDLLoader::read_animations() Vulnerability ID: #6615 Status: Open Tags: Bug, Fuzzer, MDL, Animation Reporter: TYGLS Report Date: Apr 29 Impact Scope Affected Component: Assimp MDL::HalfLife::HL1MDLLoader::read_animations() Vulnerability Type: Heap Buffer Overflow Specific Description: When parsing Half-Life 1 MDL files, the parser allocates an array of size 1 but writes to the second element, causing an out-of-bounds write. The code lacks boundary validation, leading to a crash. Remediation Current Status: Unfixed Recommended Measures: Add boundary validation to ensure that array write operations do not exceed the allocated size. POC Code ASAN Report ```plaintext INFO: Running with entropy power schedule (0xFF, 100). INFO: Seed: 3465220298 ./fuzzers/assimp_fuzzer: Running 1 inputs 1 time(s) each. Running: /crash/re/poc.mdl ================================================================= ==100607==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000000518 at pc 0x5efa8cb07f22 bp 0x7ffcb WRITE of size 8 at 0x502000000518 thread T0 #0 0x5efa8cb0ff1 in Assimp::MDL::HalfLife::HL1MDLLoader::read_animations() /fuzz/project/assimp/code/AssetLib/MDL/MDL/MDL/MDL.cpp:398 #1 0x5efa8cb0a3f5 in Assimp::MDL::HalfLife::HL1MDLLoader::load_file() /fuzz/project/assimp/code/AssetLib/MDL/MDL/MDL/MDL.cpp:398 #2 0x5efa8cb0aa27 in Assimp::MDL::HalfLife::HL1MDLLoader::HL1MDLLoader(aiScene, Assimp::IOSystem, unsigned int) /fuzz/project/assimp/code/AssetLib/MDL/MDL/MDL/MDL.cpp:398 #3 0x5efa8cb02384 in Assimp::MDLImporter::InternReadFile(std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem, aiScene) /fuzz/project/assimp/code/AssetLib/MDL/MDL/MDL/MDL.cpp:398 #4 0x5efa8cb0464e in Assimp::MDLImporter::InternReadFile(std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem, aiScene) /fuzz/project/assimp/code/AssetLib/MDL/MDL/MDL/MDL.cpp:398 #5 0x5efa8cb002ba in Assimp::BaseImporter::ReadFile(Assimp::Importer, std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem) /fuzz/project/assimp/code/Common/BaseImporter.cpp:40 #6 0x5efa8cb0008a in Assimp::Importer::ReadFileFromMemory(void const, unsigned long, unsigned int, char const) /fuzz/project/assimp/code/Common/Importer.cpp:824 #7 0x5efa8cb00260 in Assimp::Importer::ReadFileFromMemory(void const, unsigned long, unsigned int, char const) /fuzz/project/assimp/code/Common/Importer.cpp:824 #8 0x5efa8cb02384 in Assimp::MDLImporter::InternReadFile(std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem, aiScene) /fuzz/project/assimp/code/AssetLib/MDL/MDL/MDL/MDL.cpp:398 #9 0x5efa8cb0464e in Assimp::MDLImporter::InternReadFile(std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem, aiScene) /fuzz/project/assimp/code/AssetLib/MDL/MDL/MDL/MDL.cpp:398 #10 0x5efa8cb002ba in Assimp::BaseImporter::ReadFile(Assimp::Importer, std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem) /fuzz/project/assimp/code/Common/BaseImporter.cpp:40 #11 0x5efa8cb0008a in Assimp::Importer::ReadFileFromMemory(void const, unsigned long, unsigned int, char const) /fuzz/project/assimp/code/Common/Importer.cpp:824 #12 0x5efa8cb00260 in Assimp::Importer::ReadFileFromMemory(void const, unsigned long, unsigned int, char const) /fuzz/project/assimp/code/Common/Importer.cpp:824 #13 0x5efa8cb02384 in Assimp::MDLImporter::InternReadFile(std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem, aiScene) /fuzz/project/assimp/code/AssetLib/MDL/MDL/MDL/MDL.cpp:398 #14 0x5efa8cb0464e in Assimp::MDLImporter::InternReadFile(std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem, aiScene) /fuzz/project/assimp/code/AssetLib/MDL/MDL/MDL/MDL.cpp:398 #15 0x5efa8cb002ba in Assimp::BaseImporter::ReadFile(Assimp::Importer, std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem) /fuzz/project/assimp/code/Common/BaseImporter.cpp:40 #16 0x5efa8cb0008a in Assimp::Importer::ReadFileFromMemory(void const, unsigned long, unsigned int, char const) /fuzz/project/assimp/code/Common/Importer.cpp:824 #17 0x5efa8cb00260 in Assimp::Importer::ReadFileFromMemory(void const, unsigned long, unsigned int, char const) /fuzz/project/assimp/code/Common/Importer.cpp:824 #18 0x5efa8cb02384 in Assimp::MDLImporter::InternReadFile(std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem, aiScene) /fuzz/project/assimp/code/AssetLib/MDL/MDL/MDL/MDL.cpp:398 #19 0x5efa8cb0464e in Assimp::MDLImporter::InternReadFile(std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem, aiScene) /fuzz/project/assimp/code/AssetLib/MDL/MDL/MDL/MDL.cpp:398 #20 0x5efa8cb002ba in Assimp::BaseImporter::ReadFile(Assimp::Importer, std::__cxx11::basic_string, std::allocator > const&, Assimp::IOSystem) /fuzz/project/assimp/code/Common/BaseImporter.cpp:40 #21 0x5efa8cb0008a in Assimp::Importer::ReadFileFromMemory(void const, unsigned long, unsigned int, char cons

Goal Reached Thanks to every supporter — we hit 100%!

Assimp HL1MDLLoader Heap Buffer Overflow Vulnerability Analysis and PoC

More from this source