Skip to content

Fixed buffer overrun caused in malformed test input

Sean McBride requested to merge seanm/vtk:StreamVersionOverrun into master

vtkInteractorEventRecorder::Play()'s implementation is not very resilient against malformed input. If one of the input lines was too short, as was the case with TestPropPicker2Renderers.cxx, then the line "iss >> keySym" doesn't write anything to the 'keySym' buffer. A later invocation of strlen(keySym) overeads the buffer looking for a terminating NUL that isn't there.

Caught this with the combination of ASan and -ftrivial-auto-var-init=pattern.

Fixed TestPropPicker2Renderers.cxx to use "StreamVersion 1.1", which is is probably what it intended, as there's one less item per line vs the older format.

Added an assert that would catch this without fancy build options. This found a similar bug in TestImplicitPlaneWidget2LockNormalToCamera.cxx, fixed that too.

Also increased the size of two stack buffers to 256 to match the use of width(256).

Merge request reports