Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't crash in UsdImagingInstanceAdapter::GetScenePrimPaths when passing invalid instanceIndices #1932

Merged

Conversation

mtavenrath
Copy link
Contributor

@mtavenrath mtavenrath commented Jul 4, 2022

Description of Change(s)

Added index checking for each passed instance index to avoid out of bounds accesses.

Fixes Issue(s)

Crash when passing invalid instance indices

  • I have submitted a signed Contributor License Agreement

@asluk
Copy link
Contributor

asluk commented Jul 4, 2022

Hi @sunyab / @tcauchois -- I can do a review pass on this before you take a look later this week, if that works. This fixes some critical crashes in Omniverse that rely on GetScenePrimPaths. I'll also look to get a developer on my team to look into making a unit test if possible. Thanks!

@sunyab
Copy link
Contributor

sunyab commented Jul 5, 2022

Filed as internal issue #USD-7470

Comment on lines 2555 to 2558
// not a single index valid valid, make empty requestedIndicesMap
if (minIdx > maxIdx)
minIdx = maxIdx;

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment says that requestedIndicesMap created below will be empty in this case, but it appears it will be a vector of size 1 instead.

But as a simplification: if there isn't a single valid index, can't we just return immediately?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I updated the code to skip the whole loop if there's no valid instance index.

if (instanceIndex < indices.size()) {
int remappedIndex = indices[instanceIndex];
requestedIndicesMap[remappedIndex - minIdx] = i;
}
}

result.resize(instanceIndices.size());
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This resize call doesn't seem to take into account whether there were any invalid entries in instanceIndices, so in that case result will be too large and contain empty paths, which clients likely won't expect. Do we need to do some extra handling here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I changed the code to count the number of valid indices for a correct resize.

@sunyab
Copy link
Contributor

sunyab commented Jul 5, 2022

@asluk We're getting ready to publish 22.08-rc1 in the next few days and since this is a regression introduced in this release we'd like to merge this as soon as possible. I've left some initial review notes and will update if there are additional notes from the team.

@asluk
Copy link
Contributor

asluk commented Jul 5, 2022

@asluk We're getting ready to publish 22.08-rc1 in the next few days and since this is a regression introduced in this release we'd like to merge this as soon as possible. I've left some initial review notes and will update if there are additional notes from the team.

Thanks @sunyab ; I don't have any further notes on the PR on top of yours.

@mtavenrath mtavenrath requested a review from sunyab July 7, 2022 06:59
@pixar-oss pixar-oss merged commit 6394d3a into PixarAnimationStudios:dev Jul 7, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants