Skip to content

decoder: avoid signed overflow in texture prediction - #1225

Merged
igorvytyaz merged 2 commits into
google:mainfrom
Alb3e3:fix-ossfuzz-553263223
Sep 24, 2026
Merged

igorvytyaz merged 2 commits into
google:mainfrom
Alb3e3:fix-ossfuzz-553263223

Conversation

@Alb3e3

@Alb3e3 Alb3e3 commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Summary

The minimized OSS-Fuzz testcase for issue 553263223 reaches the portable texture-coordinate predictor with untrusted values that overflow signed int64_t during scaled UV addition. UBSan reports the overflow in VectorD::operator+.

Perform the intermediate vector arithmetic in uint64_t before converting back to the signed vector. Valid bitstreams retain their results, while malformed geometry no longer invokes signed-overflow undefined behavior during decoding.

Validation: rebuilt Draco with AddressSanitizer and UndefinedBehaviorSanitizer and replayed the minimized point-cloud and mesh decoder harnesses without findings.

This is a Google Patch Rewards OSS-Fuzz Tier 2 patch. AI assistance was used and is disclosed.

@igorvytyaz
igorvytyaz merged commit 15bdb3a into google:main Sep 24, 2026
37 checks passed
@igorvytyaz

Copy link
Copy Markdown
Collaborator

Thank you for making this contribution to Draco, @Alb3e3!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants