Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bugfix. Insufficient pattern matching can lead to crash. #446

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

MattiasOhmanSony
Copy link

by using continue the loop does not restart the pattern matching and it can lead to that we get faulty indexes that in turn can lead to crashing. The correct code here is to break in the inner loop so we return to the outer loop.

by using continue the loop does not restart the pattern matching and it can lead to that we get faulty indexes that in turn can lead to crashing. The correct code here is to break in the inner loop so we return to the outer loop.
@MattiasOhmanSony
Copy link
Author

The current pattern matching will give false positives if only one character matches and it can lead to crashes. using break will exit the inner loop and advance the c_start index to the next character in the pData pointer and start the pattern matching again (i.e look for JSON) this is correct. Continue will not advance or restart the inner loop.

@MattiasOhmanSony
Copy link
Author

@ruyo I have confirmed cases where this happen with certain VRM files so i highly suggest that this gets fixed. It's changing two lines of code from continue to break.

diff --git a/Source/VRM4ULoader/Private/VrmJson.cpp b/Source/VRM4ULoader/Private/VrmJson.cpp
index d8502f18..a8130bb6 100644
--- a/Source/VRM4ULoader/Private/VrmJson.cpp
+++ b/Source/VRM4ULoader/Private/VrmJson.cpp
@@ -19,7 +19,7 @@ bool VrmJson::init(const uint8_t* pData, size_t size) {

		for (int i = 0; i < 4; ++i) {
			if (str[i] != pData[c_start + i]) {
  •   			continue;
    
  •   			break;
      		}
      		bFound = true;
      	}
    

@@ -74,7 +74,7 @@ bool VRMIsVRM10(const uint8_t* pData, size_t size) {

		for (int i = 0; i < 4; ++i) {
			if (str[i] != pData[c_start + i]) {
  •   			continue;
    
  •   			break;
      		}
      		bFound = true;
      	}
    

https://github.com/ruyo/VRM4U/commit/7cb4e7312a848827919f48d792683312d881a33c.diff

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant