Skip to content

Radient: GLTF Loader does not validate node graph sufficiently #266

Description

@TheMostDiligent

RadientGLTFConverter.cpp calls the recursive CreateNode() implementation. It has no cycle check and no depth limit. A malformed cyclic imported graph can therefore recurse indefinitely. An extremely deep, otherwise valid graph can overflow the thread stack.

Recommended fix

Perform graph validation before scheduling any mesh work:

enum class VisitState : Uint8
{
    Unvisited,
    Visiting,
    Complete
};

For every child edge:

  • validate the child index,
  • increment and validate its parent count,
  • reject an edge to a Visiting node,
  • allow a Complete node only when it is being referenced by another scene as the same root, not by a second parent.

For scene-less documents, synthesize a scene from nodes whose parent count is zero, not from every node.

Instantiate iteratively using an explicit stack:

struct NodeWork
{
    Uint32          NodeIndex;
    RadientEntityID Parent;
};

That removes recursion depth as an input-controlled resource.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions