Validate face buffer of subdivision meshes - #631
Open
stefanatwork wants to merge 1 commit into
Open
stefanatwork wants to merge 1 commit into
stefanatwork wants to merge 1 commit into
Conversation
The half edge of a face is looked up through the prefix sum of the face valences stored in the face buffer, but this buffer was never validated. A face with zero vertices produced a start offset that pointed behind the half edge array, thus dereferencing the half edge of such a face during commit read out of bounds. A face buffer whose valences sum up to more than the size of an index buffer caused the half edge array, which is sized through the index buffer, to get written out of bounds. The sum was further accumulated in 32 bit, thus it could also wrap around. The face buffer now gets validated before the half edge structures are built, and inconsistent face and index buffers raise an RTC_ERROR_INVALID_OPERATION error. The check is performed before any state is updated, thus a rejected geometry is left unmodified. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
svenwoop
requested changes
Sep 23, 2026
| However, the indices of the topologies themselves may be different. | ||
|
|
||
| The face buffer has to be consistent with the index buffers, thus each | ||
| face must have at least 3 vertices and the sum of all face vertex |
Collaborator
There was a problem hiding this comment.
Don't we handle the special cases of 0,1,2 vertices correctly? These probably get already filtered out correctly. We just need to check that index array is properly sized.
Collaborator
There was a problem hiding this comment.
Currently the code just filters these out, we should keep that behavior.
| halfEdges.resize(mesh->numEdges()); | ||
|
|
||
| /* the index buffer of each topology has to be large enough for all half edges */ | ||
| if (vertexIndices.size() < mesh->numHalfEdges) |
Collaborator
There was a problem hiding this comment.
this check should be all that is needed
svenwoop
requested changes
Sep 23, 2026
| However, the indices of the topologies themselves may be different. | ||
|
|
||
| The face buffer has to be consistent with the index buffers, thus each | ||
| face must have at least 3 vertices and the sum of all face vertex |
Collaborator
There was a problem hiding this comment.
Currently the code just filters these out, we should keep that behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The half edge of a face is looked up through the prefix sum of the face valences stored in the face buffer, but this buffer was never validated.
A face with zero vertices produced a start offset that pointed behind the half edge array, thus dereferencing the half edge of such a face during commit read out of bounds. A face buffer whose valences sum up to more than the size of an index buffer caused the half edge array, which is sized through the index buffer, to get written out of bounds. The sum was further accumulated in 32 bit, thus it could also wrap around.
The face buffer now gets validated before the half edge structures are built, and inconsistent face and index buffers raise an RTC_ERROR_INVALID_OPERATION error. The check is performed before any state is updated, thus a rejected geometry is left unmodified.