Panic when opening a particular GLB model

[wlinna]

I have a GLB file that causes a panic when opening. The file works fine on ThreeJS, so I think gltf-rs should be able to handle it as well, or at least fail gracefully.

The GLB file is available here: https://drive.google.com/file/d/1tPjXiUlLO2Drh1hdGnqYg4KTpQVUGDZM/view?usp=sharing

This is how I open it: let gltf_result = gltf::Gltf::open(gltf_path);

This is how I added gltf-rs to my project:

[dependencies.gltf]
version = "0.15.2"
features = ["extras", "names"]

I'm running this on Windows 10

Here's my backtrace:

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Utf8Error { valid_up_to: 37080, error_len: Some(1) }', C:\Users\William\.cargo\registry\src\github.com-1ecc6299db9ec823\serde_json-1.0.62\src\read.rs:590:39
stack backtrace:
   0:     0x7ff788db602e - std::backtrace_rs::backtrace::dbghelp::trace
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\..\..\backtrace\src\backtrace\dbghelp.rs:98
   1:     0x7ff788db602e - std::backtrace_rs::backtrace::trace_unsynchronized
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\..\..\backtrace\src\backtrace\mod.rs:66
   2:     0x7ff788db602e - std::sys_common::backtrace::_print_fmt
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\sys_common\backtrace.rs:67
   3:     0x7ff788db602e - std::sys_common::backtrace::_print::{{impl}}::fmt
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\sys_common\backtrace.rs:46
   4:     0x7ff788dcb46b - core::fmt::write
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\core\src\fmt\mod.rs:1078
   5:     0x7ff788db2d68 - std::io::Write::write_fmt<std::sys::windows::stdio::Stderr>
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\io\mod.rs:1517
   6:     0x7ff788db8d3d - std::sys_common::backtrace::_print
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\sys_common\backtrace.rs:49
   7:     0x7ff788db8d3d - std::sys_common::backtrace::print
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\sys_common\backtrace.rs:36
   8:     0x7ff788db8d3d - std::panicking::default_hook::{{closure}}
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\panicking.rs:208
   9:     0x7ff788db87a4 - std::panicking::default_hook
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\panicking.rs:225
  10:     0x7ff788db964e - std::panicking::rust_panic_with_hook
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\panicking.rs:591
  11:     0x7ff788db9171 - std::panicking::begin_panic_handler::{{closure}}
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\panicking.rs:497
  12:     0x7ff788db698f - std::sys_common::backtrace::__rust_end_short_backtrace<closure-0,!>
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\sys_common\backtrace.rs:141
  13:     0x7ff788db90c9 - std::panicking::begin_panic_handler
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\panicking.rs:493
  14:     0x7ff788dc9ce0 - core::panicking::panic_fmt
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\core\src\panicking.rs:92
  15:     0x7ff788dc9b13 - core::option::expect_none_failed
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\core\src\option.rs:1268
  16:     0x7ff788d118e3 - <serde_json::read::SliceRead as serde_json::read::Read>::end_raw_buffering::h165aafa87c8c6029
  17:     0x7ff788d3bfa9 - serde::de::impls::<impl serde::de::Deserialize for core::option::Option<T>>::deserialize::ha06fb090d4236aef
  18:     0x7ff788ce7962 - <&mut serde_json::de::Deserializer<R> as serde::de::Deserializer>::deserialize_struct::hba48bb77ea142763
  19:     0x7ff788c61078 - serde_json::de::from_slice::h3836aa9c3b3cd499
  20:     0x7ff788d143e0 - gltf::Gltf::open::hb08f961e943d3633
  21:     0x7ff788d2aeb9 - gltf_json::buffer::_::<impl serde::ser::Serialize for gltf_json::buffer::Buffer>::serialize::h19c494229f56da83
  22:     0x7ff788d40396 - std::sys_common::backtrace::__rust_begin_short_backtrace::h01a04b517b454299
  23:     0x7ff788d27acc - std::io::Write::write_all::h870ea463cf95b7f7
  24:     0x7ff788db9804 - core::ops::function::impls::{{impl}}::call_once
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\library\core\src\ops\function.rs:280
  25:     0x7ff788db9804 - std::panicking::try::do_call
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\panicking.rs:379
  26:     0x7ff788db9804 - std::panicking::try
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\panicking.rs:343
  27:     0x7ff788db9804 - std::panic::catch_unwind
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\panic.rs:396
  28:     0x7ff788db9804 - std::rt::lang_start_internal
                               at /rustc/cb75ad5db02783e8b0222fee363c5f63f7e2cf5b\/library\std\src\rt.rs:51
  29:     0x7ff788d2cd17 - main
  30:     0x7ff788dd1bfc - invoke_main
                               at d:\agent\_work\63\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
  31:     0x7ff788dd1bfc - __scrt_common_main_seh
                               at d:\agent\_work\63\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
  32:     0x7ffbbe627034 - BaseThreadInitThunk
  33:     0x7ffbbf23d241 - RtlUserThreadStart

Here's the validation log:

{
    "uri": "crashbug.glb",
    "mimeType": "model/gltf-binary",
    "validatorVersion": "2.0.0-dev.3.3",
    "validatedAt": "2021-02-25T13:50:53.951Z",
    "issues": {
        "numErrors": 1,
        "numWarnings": 0,
        "numInfos": 0,
        "numHints": 0,
        "messages": [
            {
                "code": "INVALID_JSON",
                "message": "Invalid JSON data. Parser output: FormatException: Missing extension byte (at offset 809193)",
                "severity": 0,
                "pointer": ""
            }
        ],
        "truncated": false
    }
}

[wlinna]

Found it! I was able to create a small test case. The bug is in serde_json.

let json_str2 = &[ b'"', b'\xCE', b'\xF8', b'"'];
let v2: serde_json::Result<Box<serde_json::value::RawValue>> = serde_json::from_slice(json_str2);

I will report this bug in serde_json's bug tracker.

[wlinna]

At least with the recently published 1.0.64, json parsing doesn't panic anymore, just returns a Result::Err. Though the file works with Three.js, it doesn't work with Blender, and the error is categorized as an error by the gltf validator too. I suppose it's not worth it to try to work around the issue.

[repi]

if this doesn't panic anymore, then the issue could be closed?

[wlinna]

Cargo.toml of this repo doesn't require 1.0.64 or higher of serde_json. I'm not sure.. maybe that version should be bumped to make sure that the old version won't be installed?

[alteous]

359 should have fixed this issue. Please re-open otherwise.