From 5c4747ecc7194b7f8435408d1049f22112a5e347 Mon Sep 17 00:00:00 2001 From: Joseph Lenox Date: Fri, 19 Mar 2021 10:57:00 -0500 Subject: [PATCH] Fix CVE-2020-28591 by dropping vertices that are illegal in the facet list. --- src/libslic3r/Format/AMF.cpp | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/src/libslic3r/Format/AMF.cpp b/src/libslic3r/Format/AMF.cpp index c6b4f9113..a74861f09 100644 --- a/src/libslic3r/Format/AMF.cpp +++ b/src/libslic3r/Format/AMF.cpp @@ -591,9 +591,14 @@ void AMFParserContext::endElement(const char * /* name */) // Faces of the current volume: case NODE_TYPE_TRIANGLE: assert(m_object && m_volume); - m_volume_facets.push_back(atoi(m_value[0].c_str())); - m_volume_facets.push_back(atoi(m_value[1].c_str())); - m_volume_facets.push_back(atoi(m_value[2].c_str())); + // drop illegal vertex references. + if (strtoul(m_value[0].c_str(), nullptr, 10) < m_object_vertices.size() && + strtoul(m_value[1].c_str(), nullptr, 10) < m_object_vertices.size() && + strtoul(m_value[2].c_str(), nullptr, 10) < m_object_vertices.size()) { + m_volume_facets.push_back(atoi(m_value[0].c_str())); + m_volume_facets.push_back(atoi(m_value[1].c_str())); + m_volume_facets.push_back(atoi(m_value[2].c_str())); + } m_value[0].clear(); m_value[1].clear(); m_value[2].clear();