Bug 891787 – <media-libs/assimp-5.2.5-r1: heap use after free

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description John Helmert III 2023-01-22 23:45:51 UTC]

CVE-2022-45748:

An issue was discovered with assimp 5.1.4, a use after free occurred in function ColladaParser::ExtractDataObjectFromChannel in file /code/AssetLib/Collada/ColladaParser.cpp.

Unfixed, even though one might read the CVE otherwise.

[Comment 1 Bernd 2023-01-23 08:14:24 UTC]

We can manually disable the COLLADA importer and/or exporter. If I read the CVE correctly, only the importer seems to be affected, correct me, if I'm wrong. To be on the safe side, we can disable both for the time being.

[Comment 2 John Helmert III 2023-01-23 14:50:27 UTC]

I agree that it *looks* like the bug is in importer functionality based on the backtraces in the bug, but I don't have any familiarity with this software.

[Comment 3 Bernd 2023-01-23 18:48:07 UTC]

I disable both. Some more tests are failing due to poor test design, when these options are disabled, which I also need to take care of.

[Comment 4 Larry the Git Cow 2023-02-05 09:12:58 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=abea5e37fe1b382f5809945fef52c18306cea76c

commit abea5e37fe1b382f5809945fef52c18306cea76c
Author:     Bernd Waibel <[e-mail]>
AuthorDate: 2023-01-23 18:15:48 +0000
Commit:     Joonas Niilola <[e-mail]>
CommitDate: 2023-02-05 09:12:52 +0000

    media-libs/assimp: don't build COLLADA module
    
    Avoid a security issue when processing COLLADA files.
    Don't build the module until fixed upstream.
    Need to drop additional collada related tests as well.
    
    Bug: https://github.com/assimp/assimp/issues/4286
    Bug: https://bugs.gentoo.org/891787
    Signed-off-by: Bernd Waibel <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/29231
    Signed-off-by: Joonas Niilola <[e-mail]>

 ...{assimp-5.2.5.ebuild => assimp-5.2.5-r1.ebuild} |  4 ++++
 .../files/assimp-5.2.5-disable-collada-tests.patch | 28 ++++++++++++++++++++++
 2 files changed, 32 insertions(+)

[Comment 5 Larry the Git Cow 2023-02-07 19:14:29 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ce431172cf05980f2631ee625acb8597ed392876

commit ce431172cf05980f2631ee625acb8597ed392876
Author:     Bernd Waibel <[e-mail]>
AuthorDate: 2023-02-07 18:51:30 +0000
Commit:     Andreas Sturmlechner <[e-mail]>
CommitDate: 2023-02-07 19:14:03 +0000

    media-libs/assimp: drop 5.2.4-r1
    
    Bug: https://bugs.gentoo.org/891787
    Signed-off-by: Bernd Waibel <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/29469
    Signed-off-by: Andreas Sturmlechner <[e-mail]>

 media-libs/assimp/Manifest                         |   1 -
 media-libs/assimp/assimp-5.2.4-r1.ebuild           |  67 ---------
 .../files/assimp-5.2.2-disable-failing-tests.patch |  52 -------
 ...ge-of-incompatible-minizip-data-structure.patch |  24 ---
 ...p-5.2.4-drop-failing-tests-for-abi_x86_32.patch | 165 ---------------------
 .../assimp/files/assimp-5.2.4-update-version.patch |  34 -----
 6 files changed, 343 deletions(-)

[Comment 6 John Helmert III 2023-02-20 19:53:04 UTC]

Thanks!

[Comment 7 Roland Hautz 2024-03-29 05:40:33 UTC]

The bug is closed as fixed upstream. It seems to me, that disabling collada should have been reverted already for assimp-5.3.1.ebuild