Fix heap mismatch and stack buffer overflows in model file parsing #281

New Issue

MrUnknownDE · 2026-04-05T16:19:31+02:00

MrUnknownDE commented

2026-04-05 16:19:31 +02:00

Originally created by @marcdonovan on 3/17/2026

Summary

src/libslic3r/Preset.cpp: Replace free() with delete on a new-allocated ConfigSubstitutions object. Mixing C and C++ deallocation is undefined behavior and can corrupt the heap. Reachable via a crafted 3MF file with embedded preset config substitutions.
deps_src/admesh/stlinit.cpp: Add width limits to fscanf/sscanf format strings when parsing the STL ASCII solid-name header. Unbounded %s/%[^\n] into fixed-size stack buffers allows a crafted STL file with an oversized solid name to overflow those buffers with attacker-controlled data.

These issues were identified via CodeQL static analysis (cpp/new-free-mismatch, cpp/unbounded-write).

Test plan

Load a valid ASCII STL file — solid name parsed correctly
Load a valid 3MF file with embedded presets — presets load without crash
Load a crafted ASCII STL with a solid name > 255 characters — no crash/overflow
Load a crafted 3MF with embedded preset config substitutions — no heap corruption

🤖 Generated with Claude Code

*Originally created by @marcdonovan on 3/17/2026* ## Summary - **`src/libslic3r/Preset.cpp`**: Replace `free()` with `delete` on a `new`-allocated `ConfigSubstitutions` object. Mixing C and C++ deallocation is undefined behavior and can corrupt the heap. Reachable via a crafted 3MF file with embedded preset config substitutions. - **`deps_src/admesh/stlinit.cpp`**: Add width limits to `fscanf`/`sscanf` format strings when parsing the STL ASCII solid-name header. Unbounded `%s`/`%[^\n]` into fixed-size stack buffers allows a crafted STL file with an oversized solid name to overflow those buffers with attacker-controlled data. These issues were identified via CodeQL static analysis (`cpp/new-free-mismatch`, `cpp/unbounded-write`). ## Test plan - [ ] Load a valid ASCII STL file — solid name parsed correctly - [ ] Load a valid 3MF file with embedded presets — presets load without crash - [ ] Load a crafted ASCII STL with a solid name > 255 characters — no crash/overflow - [ ] Load a crafted 3MF with embedded preset config substitutions — no heap corruption 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/OrcaSlicer#281