NULL pointer dereference in 3MF XML parser (triangle tag without v1/v2/v3 attribute)

eldstal commented 2 years ago

Summary

A crafted 3MF XML document can cause a crash due to a NULL pointer dereference during parsing.

Vulnerable versions

Slic3r (commit b1a5500f427700ac3dffc0e7d9535ea65f993537)

Step to reproduce

Create the proof-of-concept OBJ file (3dmodel.3dmodel):

<model>
<resources>
<object id="1">
  <mesh>
    <vertices>
      <triangle />
    </vertices>
  </mesh>
</object>
</resources>
</model>

Pack the file into a zip archive together with the prerequisite other files from a 3mf file:
```
3D/3dmodel.3dmodel
rels/.rels
[Content_Types].xml
```
Rename the zip archive to nullptr_3mf_triangle.3mf
Execute slic3r --info nullptr_3mf_triangle.3mf
Observe segmentation fault.

Example file

nullptr_3mf_triangle.zip

Cause

get_attribute() in TMF.cpp returns NULL if the sought attribute is missing. The NULL check at TMF.cpp:590 is ineffective, since self->stop() does not terminate the current function.

Execution continues to line 593, where atoi receives a NULL pointer input, and a crash results.

Impact

Denial of Service.

Proposed mitigation

Throw an exception in TMFParserContext::stop() to ensure that file parsing stops immediately.

eldstal commented 2 years ago

This vulnerability has been assigned CVE-2021-45847.

supermerill commented 2 years ago

not present in merill-merge branch

slic3r / Slic3r