Validate array-typed members before array access during deserialization#176
Open
SergioRZMasson wants to merge 2 commits into
Open
Validate array-typed members before array access during deserialization#176SergioRZMasson wants to merge 2 commits into
SergioRZMasson wants to merge 2 commits into
Conversation
…lization Cover node children, node weights and mesh weights: a present member of the wrong container type, or an array element of the wrong type, must throw InvalidGLTFException. Includes positive coverage that valid arrays still deserialize. Tests currently fail against the unguarded parser. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 039828de-4db2-48f8-a5de-c9f7d33baffa
Node children and node/mesh weights were read with rapidjson array and element accessors without first confirming the member is a JSON array of the expected element type. A present member of a different JSON type - or an array element of the wrong type - is now rejected with InvalidGLTFException before any array/number accessor is used. Node weights and mesh weights share RapidJsonUtils::ToFloatArray, so the element-type guard is centralized in that helper. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 039828de-4db2-48f8-a5de-c9f7d33baffa
bghgary
approved these changes
Jul 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Validates array-typed glTF members before reading them with rapidjson array/element accessors.
Problem
ParseNodeChildren(nodechildren) andRapidJsonUtils::ToFloatArray(nodeweightsand meshweights) read rapidjson array size/capacity/element accessors and per-element number accessors without first confirming the member is a JSON array of the expected element type.rapidjson's array and number accessors are only well-defined once the value's type has been checked (in release builds the type asserts are compiled out). When schema validation is disabled, a present member of a different JSON type — for example a string supplied where an array is expected — reaches these accessors, and the value's storage is read as array metadata rather than being rejected.
Fix
RapidJsonUtils::ToFloatArraynow throwsInvalidGLTFExceptionunless the member is a JSON array whose elements are all numbers. Node weights and mesh weights share this helper, so the guard is centralized there.ParseNodeChildrennow throwsInvalidGLTFExceptionunlesschildrenis a JSON array of unsigned integers.Absent optional members are still accepted (unchanged), and valid arrays deserialize exactly as before.
Tests
Adds positive and negative regression tests in
GLTFSDK.Testfor node children, node weights and mesh weights, covering both a wrong container type (non-array) and a wrong element type (non-number / non-index). The negative tests useSchemaFlags::DisableSchemaRootso the malformed value reaches the semantic deserializers — a consumer that disables JSON-schema validation must still get a cleanInvalidGLTFExceptionrather than undefined behaviour.Validation
Full
GLTFSDK.Testsuite passes on Windows x64 and Win32, Debug and RelWithDebInfo: 353/353.