Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Embree: AddressSanitizer: heap-buffer-overflow #1283

Open
dvicini opened this issue Aug 21, 2024 · 0 comments
Open

Embree: AddressSanitizer: heap-buffer-overflow #1283

dvicini opened this issue Aug 21, 2024 · 0 comments

Comments

@dvicini
Copy link
Member

dvicini commented Aug 21, 2024

I was running the Mitsuba tests using the AddressSanitizer and ran into an issue in test_mesh.py:

==2801657==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5040001c51c0 at pc 0x7f96e617b420 bp 0x7fff118cc410 sp 0x7fff118cc408
READ of size 4 at 0x5040001c51c0 thread T0
    #0 0x7f96e617b41f in checkPadding16 .../embree/embree_3_13_5/kernels/common/buffer.h:217:39
    #1 0x7f96e617b41f in embree::TriangleMesh::setBuffer(RTCBufferType, unsigned int, RTCFormat, embree::Ref<embree::Buffer> const&, unsigned long, unsigned long, unsigned int) .../embree/embree_3_13_5/kernels/common/scene_triangle_mesh.cpp:54:22
    #2 0x7f96e60817ac in rtcSetSharedGeometryBuffer .../embree/embree_3_13_5/kernels/common/rtcore.cpp:1434:15
    #3 0x7f96edc950c6 in mitsuba::Mesh<float, mitsuba::Color<float, 3ul>>::embree_geometry(RTCDeviceTy*) .../mitsuba/src/render/mesh.cpp:1827:5
    #4 0x7f96eddcd986 in mitsuba::Scene<float, mitsuba::Color<float, 3ul>>::accel_parameters_changed_cpu() .../mitsuba/src/render/scene_embree.inl:148:35

Embree checks that all buffers have at least a 16 byte padding: https://github.com/mitsuba-renderer/embree/blob/598978bb21d098b6a7833fa889a2b5b38be6f026/kernels/common/scene_triangle_mesh.cpp#L54

It performs this check by explicitly trying to read beyond the end of the specified array size. My understanding is that this is done in order to detect if SIMD instructions will potentially read outside the provided array.

As far as I can tell, we don't ensure that the vertex buffers we have are padded. These buffers might even have been created outside of Mitsuba (e.g., when creating vertices with NumPy).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant