From 293465a5161b621ec3dddb84e94924bcb74e0e60 Mon Sep 17 00:00:00 2001 From: Sam Edwards Date: Thu, 22 Feb 2018 03:13:06 -0700 Subject: [PATCH] bam: Add sanity-check against object IDs appearing twice Found this by fuzzing; not concerned about updating the writer as the writer itself should never do this. This is just to protect against segfaults in the face of corrupt or malicious bams. --- panda/src/putil/bamReader.cxx | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/panda/src/putil/bamReader.cxx b/panda/src/putil/bamReader.cxx index d432d7a4ae..30ad07415a 100644 --- a/panda/src/putil/bamReader.cxx +++ b/panda/src/putil/bamReader.cxx @@ -1159,6 +1159,16 @@ p_read_object() { // This object had already existed; thus, we are just receiving an // update for it. + if (_object_pointers.find(object_id) != _object_pointers.end()) { + // Aieee! This object isn't even complete from the last time we + // encountered it in the stream! This should never happen. Something's + // corrupt or the stream was maliciously crafted. + bam_cat.error() + << "Found object " << object_id << " in bam stream again while " + << "trying to resolve its own pointers.\n"; + return 0; + } + // Update _now_creating during this call so if this function calls // read_pointer() or register_change_this() we'll match it up properly. // This might recursively call back into this p_read_object(), so be