Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
+ add security checks to SoBrep nodes
  • Loading branch information
wwmayer committed Oct 7, 2015
1 parent 7ca6bb4 commit 70d86ce
Show file tree
Hide file tree
Showing 5 changed files with 95 additions and 35 deletions.
32 changes: 27 additions & 5 deletions src/Mod/Part/Gui/SoBrepEdgeSet.cpp
Expand Up @@ -50,6 +50,7 @@
# include <Inventor/elements/SoGLCacheContextElement.h>
# include <Inventor/elements/SoLineWidthElement.h>
# include <Inventor/elements/SoPointSizeElement.h>
# include <Inventor/errors/SoDebugError.h>
# include <Inventor/errors/SoReadError.h>
# include <Inventor/details/SoFaceDetail.h>
# include <Inventor/details/SoLineDetail.h>
Expand Down Expand Up @@ -153,7 +154,12 @@ void SoBrepEdgeSet::renderHighlight(SoGLRenderAction *action)
int num = (int)this->hl.size();
if (num > 0) {
const int32_t* id = &(this->hl[0]);
renderShape(static_cast<const SoGLCoordinateElement*>(coords), id, num);
if (!validIndexes(coords, this->hl)) {
SoDebugError::postWarning("SoBrepEdgeSet::renderHighlight", "highlightIndex out of range");
}
else {
renderShape(static_cast<const SoGLCoordinateElement*>(coords), id, num);
}
}
state->pop();
}
Expand Down Expand Up @@ -192,12 +198,26 @@ void SoBrepEdgeSet::renderSelection(SoGLRenderAction *action)
if (num > 0) {
cindices = &(this->sl[0]);
numcindices = (int)this->sl.size();

renderShape(static_cast<const SoGLCoordinateElement*>(coords), cindices, numcindices);
if (!validIndexes(coords, this->sl)) {
SoDebugError::postWarning("SoBrepEdgeSet::renderSelection", "selectionIndex out of range");
}
else {
renderShape(static_cast<const SoGLCoordinateElement*>(coords), cindices, numcindices);
}
}
state->pop();
}

bool SoBrepEdgeSet::validIndexes(const SoCoordinateElement* coords, const std::vector<int32_t>& pts) const
{
for (std::vector<int32_t>::const_iterator it = pts.begin(); it != pts.end(); ++it) {
if (*it >= coords->getNum()) {
return false;
}
}
return true;
}

static void createIndexArray(const int32_t* segm, int numsegm,
const int32_t* cindices, int numcindices,
std::vector<int32_t>& out)
Expand Down Expand Up @@ -292,8 +312,10 @@ void SoBrepEdgeSet::doAction(SoAction* action)
switch (selaction->getType()) {
case Gui::SoSelectionElementAction::Append:
{
int start = this->selectionIndex.getNum();
this->selectionIndex.set1Value(start, index);
if (this->selectionIndex.find(index) < 0) {
int start = this->selectionIndex.getNum();
this->selectionIndex.set1Value(start, index);
}
}
break;
case Gui::SoSelectionElementAction::Remove:
Expand Down
2 changes: 2 additions & 0 deletions src/Mod/Part/Gui/SoBrepEdgeSet.h
Expand Up @@ -33,6 +33,7 @@
#include <Inventor/elements/SoReplacedElement.h>
#include <vector>

class SoCoordinateElement;
class SoGLCoordinateElement;
class SoTextureCoordinateBundle;

Expand Down Expand Up @@ -66,6 +67,7 @@ class PartGuiExport SoBrepEdgeSet : public SoIndexedLineSet {
int num_vertexindices);
void renderHighlight(SoGLRenderAction *action);
void renderSelection(SoGLRenderAction *action);
bool validIndexes(const SoCoordinateElement*, const std::vector<int32_t>&) const;

private:
std::vector<int32_t> hl, sl;
Expand Down
61 changes: 36 additions & 25 deletions src/Mod/Part/Gui/SoBrepFaceSet.cpp
Expand Up @@ -51,6 +51,7 @@
# include <Inventor/elements/SoGLCacheContextElement.h>
# include <Inventor/elements/SoLineWidthElement.h>
# include <Inventor/elements/SoPointSizeElement.h>
# include <Inventor/errors/SoDebugError.h>
# include <Inventor/errors/SoReadError.h>
# include <Inventor/details/SoFaceDetail.h>
# include <Inventor/details/SoLineDetail.h>
Expand Down Expand Up @@ -134,8 +135,10 @@ void SoBrepFaceSet::doAction(SoAction* action)
switch (selaction->getType()) {
case Gui::SoSelectionElementAction::Append:
{
int start = this->selectionIndex.getNum();
this->selectionIndex.set1Value(start, index);
if (this->selectionIndex.find(index) < 0) {
int start = this->selectionIndex.getNum();
this->selectionIndex.set1Value(start, index);
}
}
break;
case Gui::SoSelectionElementAction::Remove:
Expand Down Expand Up @@ -704,33 +707,37 @@ void SoBrepFaceSet::renderHighlight(SoGLRenderAction *action)
mb.sendFirst(); // make sure we have the correct material

int32_t id = this->highlightIndex.getValue();
if (id >= this->partIndex.getNum()) {
SoDebugError::postWarning("SoBrepFaceSet::renderHighlight", "highlightIndex out of range");
}
else {
// just in case someone forgot
if (!mindices) mindices = cindices;
if (!nindices) nindices = cindices;
pindices = this->partIndex.getValues(0);

// just in case someone forgot
if (!mindices) mindices = cindices;
if (!nindices) nindices = cindices;
pindices = this->partIndex.getValues(0);
// coords
int length = (int)pindices[id]*4;
int start=0;
for (int i=0;i<id;i++)
start+=(int)pindices[i];
start *= 4;

// coords
int length = (int)pindices[id]*4;
int start=0;
for (int i=0;i<id;i++)
start+=(int)pindices[i];
start *= 4;

// normals
if (nbind == PER_VERTEX_INDEXED)
nindices = &(nindices[start]);
else if (nbind == PER_VERTEX)
normals = &(normals[start]);
else
nbind = OVERALL;
// normals
if (nbind == PER_VERTEX_INDEXED)
nindices = &(nindices[start]);
else if (nbind == PER_VERTEX)
normals = &(normals[start]);
else
nbind = OVERALL;

// materials
mbind = OVERALL;
doTextures = FALSE;
// materials
mbind = OVERALL;
doTextures = FALSE;

renderShape(static_cast<const SoGLCoordinateElement*>(coords), &(cindices[start]), length,
&(pindices[id]), 1, normals, nindices, &mb, mindices, &tb, tindices, nbind, mbind, doTextures?1:0);
renderShape(static_cast<const SoGLCoordinateElement*>(coords), &(cindices[start]), length,
&(pindices[id]), 1, normals, nindices, &mb, mindices, &tb, tindices, nbind, mbind, doTextures?1:0);
}
state->pop();
}

Expand Down Expand Up @@ -787,6 +794,10 @@ void SoBrepFaceSet::renderSelection(SoGLRenderAction *action)

for (int i=0; i<numSelected; i++) {
int id = selected[i];
if (id >= this->partIndex.getNum()) {
SoDebugError::postWarning("SoBrepFaceSet::renderSelection", "selectionIndex out of range");
break;
}

// coords
int length = (int)pindices[id]*4;
Expand Down
33 changes: 28 additions & 5 deletions src/Mod/Part/Gui/SoBrepPointSet.cpp
Expand Up @@ -50,6 +50,7 @@
# include <Inventor/elements/SoGLCacheContextElement.h>
# include <Inventor/elements/SoLineWidthElement.h>
# include <Inventor/elements/SoPointSizeElement.h>
# include <Inventor/errors/SoDebugError.h>
# include <Inventor/errors/SoReadError.h>
# include <Inventor/details/SoFaceDetail.h>
# include <Inventor/details/SoLineDetail.h>
Expand Down Expand Up @@ -143,8 +144,12 @@ void SoBrepPointSet::renderHighlight(SoGLRenderAction *action)
mb.sendFirst(); // make sure we have the correct material

int32_t id = this->highlightIndex.getValue();

renderShape(static_cast<const SoGLCoordinateElement*>(coords), &id, 1);
if (id < this->startIndex.getValue() || id >= coords->getNum()) {
SoDebugError::postWarning("SoBrepPointSet::renderHighlight", "highlightIndex out of range");
}
else {
renderShape(static_cast<const SoGLCoordinateElement*>(coords), &id, 1);
}
state->pop();
}

Expand Down Expand Up @@ -173,10 +178,26 @@ void SoBrepPointSet::renderSelection(SoGLRenderAction *action)
cindices = this->selectionIndex.getValues(0);
numcindices = this->selectionIndex.getNum();

renderShape(static_cast<const SoGLCoordinateElement*>(coords), cindices, numcindices);
if (!validIndexes(coords, this->startIndex.getValue(), cindices, numcindices)) {
SoDebugError::postWarning("SoBrepPointSet::renderSelection", "selectionIndex out of range");
}
else {
renderShape(static_cast<const SoGLCoordinateElement*>(coords), cindices, numcindices);
}
state->pop();
}

bool SoBrepPointSet::validIndexes(const SoCoordinateElement* coords, int32_t startIndex, const int32_t * cindices, int numcindices) const
{
for (int i=0; i<numcindices; i++) {
int32_t id = cindices[i];
if (id < startIndex || id >= coords->getNum()) {
return false;
}
}
return true;
}

void SoBrepPointSet::doAction(SoAction* action)
{
if (action->getTypeId() == Gui::SoHighlightElementAction::getClassTypeId()) {
Expand Down Expand Up @@ -226,8 +247,10 @@ void SoBrepPointSet::doAction(SoAction* action)
switch (selaction->getType()) {
case Gui::SoSelectionElementAction::Append:
{
int start = this->selectionIndex.getNum();
this->selectionIndex.set1Value(start, index);
if (this->selectionIndex.find(index) < 0) {
int start = this->selectionIndex.getNum();
this->selectionIndex.set1Value(start, index);
}
}
break;
case Gui::SoSelectionElementAction::Remove:
Expand Down
2 changes: 2 additions & 0 deletions src/Mod/Part/Gui/SoBrepPointSet.h
Expand Up @@ -33,6 +33,7 @@
#include <Inventor/elements/SoReplacedElement.h>
#include <vector>

class SoCoordinateElement;
class SoGLCoordinateElement;
class SoTextureCoordinateBundle;

Expand Down Expand Up @@ -62,6 +63,7 @@ class PartGuiExport SoBrepPointSet : public SoPointSet {
int num_vertexindices);
void renderHighlight(SoGLRenderAction *action);
void renderSelection(SoGLRenderAction *action);
bool validIndexes(const SoCoordinateElement*, int32_t, const int32_t *, int) const;

private:
SbColor selectionColor;
Expand Down

0 comments on commit 70d86ce

Please sign in to comment.