VRM4U icon indicating copy to clipboard operation
VRM4U copied to clipboard

Bugfix. Insufficient pattern matching can lead to crash.

Open MattiasOhmanSony opened this issue 1 year ago • 2 comments

by using continue the loop does not restart the pattern matching and it can lead to that we get faulty indexes that in turn can lead to crashing. The correct code here is to break in the inner loop so we return to the outer loop.

MattiasOhmanSony avatar Nov 14 '24 15:11 MattiasOhmanSony

The current pattern matching will give false positives if only one character matches and it can lead to crashes. using break will exit the inner loop and advance the c_start index to the next character in the pData pointer and start the pattern matching again (i.e look for JSON) this is correct. Continue will not advance or restart the inner loop.

MattiasOhmanSony avatar Nov 14 '24 15:11 MattiasOhmanSony

@ruyo I have confirmed cases where this happen with certain VRM files so i highly suggest that this gets fixed. It's changing two lines of code from continue to break.

diff --git a/Source/VRM4ULoader/Private/VrmJson.cpp b/Source/VRM4ULoader/Private/VrmJson.cpp index d8502f18..a8130bb6 100644 --- a/Source/VRM4ULoader/Private/VrmJson.cpp +++ b/Source/VRM4ULoader/Private/VrmJson.cpp @@ -19,7 +19,7 @@ bool VrmJson::init(const uint8_t* pData, size_t size) {

		for (int i = 0; i < 4; ++i) {
			if (str[i] != pData[c_start + i]) {
  •   			continue;
    
  •   			break;
      		}
      		bFound = true;
      	}
    

@@ -74,7 +74,7 @@ bool VRMIsVRM10(const uint8_t* pData, size_t size) {

		for (int i = 0; i < 4; ++i) {
			if (str[i] != pData[c_start + i]) {
  •   			continue;
    
  •   			break;
      		}
      		bFound = true;
      	}
    

https://github.com/ruyo/VRM4U/commit/7cb4e7312a848827919f48d792683312d881a33c.diff

MattiasOhmanSony avatar Dec 02 '24 13:12 MattiasOhmanSony

Thank you for your request. I apologize for not noticing it for so long. I have merged it.

ruyo avatar Aug 11 '25 10:08 ruyo