vtkGLTFDocumentLoader: Fix invalid access for CVE-2025-57106

Origin: upstream, https://gitlab.kitware.com/vtk/vtk/-/commit/bd93e0533bfff2e8519ff557a0a8637a76e5fc1b https://gitlab.kitware.com/vtk/vtk/-/commit/04b2e001539d843c0f6b52239aa0fecd5b967dc7
Bug-Debian: https://bugs.debian.org/1119821

Gbp-Pq: Name cve_2025_57106.patch

diff --git a/IO/Geometry/vtkGLTFDocumentLoader.cxx b/IO/Geometry/vtkGLTFDocumentLoader.cxx
index ace1a8c4bc6aee8ba0a8311f6380c7f6d01cf737..f1fe4ea615d1af67a566050faf1fdc79268eeced 100644 (file)
--- a/IO/Geometry/vtkGLTFDocumentLoader.cxx
+++ b/IO/Geometry/vtkGLTFDocumentLoader.cxx
@@ -315,37 +315,31 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
    * ExecuteBufferDataExtractionWorker, forwarding template types and parameters.
    */
   template <typename ArrayType, typename vtkArrayDispatchType>
-  void DispatchWorkerExecutionByComponentType(
+  bool DispatchWorkerExecutionByComponentType(
     ArrayType* output, const Accessor& accessor, const BufferView& bufferView)
   {
     switch (accessor.ComponentTypeValue)
     {
       case ComponentType::BYTE:
-        this->ExecuteBufferDataExtractionWorker<char, ArrayType, vtkArrayDispatchType>(
+        return this->ExecuteBufferDataExtractionWorker<char, ArrayType, vtkArrayDispatchType>(
           output, accessor, bufferView);
-        break;
       case ComponentType::UNSIGNED_BYTE:
-        this->ExecuteBufferDataExtractionWorker<unsigned char, ArrayType, vtkArrayDispatchType>(
+        return this->ExecuteBufferDataExtractionWorker<unsigned char, ArrayType, vtkArrayDispatchType>(
           output, accessor, bufferView);
-        break;
       case ComponentType::SHORT:
-        this->ExecuteBufferDataExtractionWorker<short, ArrayType, vtkArrayDispatchType>(
+        return this->ExecuteBufferDataExtractionWorker<short, ArrayType, vtkArrayDispatchType>(
           output, accessor, bufferView);
-        break;
       case ComponentType::UNSIGNED_SHORT:
-        this->ExecuteBufferDataExtractionWorker<uint16_t, ArrayType, vtkArrayDispatchType>(
+        return this->ExecuteBufferDataExtractionWorker<uint16_t, ArrayType, vtkArrayDispatchType>(
           output, accessor, bufferView);
-        break;
       case ComponentType::UNSIGNED_INT:
-        this->ExecuteBufferDataExtractionWorker<uint32_t, ArrayType, vtkArrayDispatchType>(
+        return this->ExecuteBufferDataExtractionWorker<uint32_t, ArrayType, vtkArrayDispatchType>(
           output, accessor, bufferView);
-        break;
       case ComponentType::FLOAT:
-        this->ExecuteBufferDataExtractionWorker<float, ArrayType, vtkArrayDispatchType>(
+        return this->ExecuteBufferDataExtractionWorker<float, ArrayType, vtkArrayDispatchType>(
           output, accessor, bufferView);
-        break;
       default:
-        return;
+        return false;
     }
   }
 
@@ -354,17 +348,17 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
    * forwarding template types and parameters.
    */
   template <typename ArrayType>
-  void DispatchWorkerExecution(
+  bool DispatchWorkerExecution(
     ArrayType* output, const Accessor& accessor, const BufferView& bufferView)
   {
     if (accessor.Normalized || accessor.ComponentTypeValue == ComponentType::FLOAT)
     {
-      this->DispatchWorkerExecutionByComponentType<ArrayType, vtkArrayDispatch::Reals>(
+      return this->DispatchWorkerExecutionByComponentType<ArrayType, vtkArrayDispatch::Reals>(
         output, accessor, bufferView);
     }
     else
     {
-      this->DispatchWorkerExecutionByComponentType<ArrayType, vtkArrayDispatch::Integrals>(
+      return this->DispatchWorkerExecutionByComponentType<ArrayType, vtkArrayDispatch::Integrals>(
         output, accessor, bufferView);
     }
   }
@@ -373,9 +367,15 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
    * Creates a new BufferDataExtractionWorker, initializes it and starts its execution
    */
   template <typename ComponentType, typename ArrayType, typename vtkArrayDispatchType>
-  void ExecuteBufferDataExtractionWorker(
+  bool ExecuteBufferDataExtractionWorker(
     ArrayType* output, const Accessor& accessor, const BufferView& bufferView)
   {
+    if (bufferView.Buffer < 0 || bufferView.Buffer >= static_cast<int>(this->Buffers->size()))
+    {
+      vtkErrorWithObjectMacro(nullptr, "Invalid buffer index:" << bufferView.Buffer);
+      return false;
+    }
+
     // Create worker
     BufferDataExtractionWorker<ComponentType> worker;
     // Set worker parameters
@@ -390,6 +390,7 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
 
     // Start worker execution
     vtkArrayDispatch::DispatchByValueType<vtkArrayDispatchType>::Execute(output, worker);
+    return true;
   }
 
   void Setup(int accessorId, vtkGLTFDocumentLoader::AccessorType expectedType)
@@ -419,13 +420,18 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
     }
 
     // Load base accessor data
-    if (accessor.BufferView >= 0)
+    if (accessor.BufferView >= 0 &&
+      accessor.BufferView < static_cast<int>(this->BufferViews->size()))
     {
       const BufferView& bufferView = this->BufferViews->operator[](accessor.BufferView);
 
       output->SetNumberOfComponents(GetNumberOfComponentsForType(this->ExpectedType));
 
-      DispatchWorkerExecution<ArrayType>(output, accessor, bufferView);
+      if (!DispatchWorkerExecution<ArrayType>(output, accessor, bufferView))
+      {
+        this->Result = false;
+        return;
+      }
     }
     else if (!accessor.IsSparse)
     {
@@ -457,7 +463,12 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
       mockIndicesAccessor.NumberOfComponents = 1;
       mockIndicesAccessor.ComponentTypeValue = sparse.IndicesComponentType;
 
-      DispatchWorkerExecution<vtkIntArray>(sparseIndices, mockIndicesAccessor, indicesBufferView);
+      if (!DispatchWorkerExecution<vtkIntArray>(
+            sparseIndices, mockIndicesAccessor, indicesBufferView))
+      {
+        this->Result = false;
+        return;
+      }
 
       // Load values
       vtkNew<ArrayType> sparseValues;
@@ -467,8 +478,12 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
       mockValuesAccessor.Count = sparse.Count;
       mockValuesAccessor.ByteOffset = sparse.ValuesByteOffset;
 
-      DispatchWorkerExecution<ArrayType>(
-        sparseValues.GetPointer(), mockValuesAccessor, valuesBufferView);
+      if (!DispatchWorkerExecution<ArrayType>(
+            sparseValues.GetPointer(), mockValuesAccessor, valuesBufferView))
+      {
+        this->Result = false;
+        return;
+      }
 
       // Replace values into original (non sparse) array
       for (int id = 0; id < sparseIndices->GetNumberOfValues(); id++)