From: Mathieu Westphal <mathieu.westphal@kitware.com>
Date: Tue, 13 Oct 2026 10:08:50 +0000 (+0200)
Subject: vtkGLTFDocumentLoader: Fix invalid access for CVE-2025-57106
X-Git-Tag: archive/raspbian/9.6.2+ds-3+rpi1^2~9
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=a34b4a27cf692c8c01658a2331149df7807fe212;p=vtk9.git

vtkGLTFDocumentLoader: Fix invalid access for CVE-2025-57106

Origin: upstream, https://gitlab.kitware.com/vtk/vtk/-/commit/bd93e0533bfff2e8519ff557a0a8637a76e5fc1b https://gitlab.kitware.com/vtk/vtk/-/commit/04b2e001539d843c0f6b52239aa0fecd5b967dc7
Bug-Debian: https://bugs.debian.org/1119821


Gbp-Pq: Name cve_2025_57106.patch
---

diff --git a/IO/Geometry/vtkGLTFDocumentLoader.cxx b/IO/Geometry/vtkGLTFDocumentLoader.cxx
index ace1a8c4b..f1fe4ea61 100644
--- a/IO/Geometry/vtkGLTFDocumentLoader.cxx
+++ b/IO/Geometry/vtkGLTFDocumentLoader.cxx
@@ -315,37 +315,31 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
    * ExecuteBufferDataExtractionWorker, forwarding template types and parameters.
    */
   template <typename ArrayType, typename vtkArrayDispatchType>
-  void DispatchWorkerExecutionByComponentType(
+  bool DispatchWorkerExecutionByComponentType(
     ArrayType* output, const Accessor& accessor, const BufferView& bufferView)
   {
     switch (accessor.ComponentTypeValue)
     {
       case ComponentType::BYTE:
-        this->ExecuteBufferDataExtractionWorker<char, ArrayType, vtkArrayDispatchType>(
+        return this->ExecuteBufferDataExtractionWorker<char, ArrayType, vtkArrayDispatchType>(
           output, accessor, bufferView);
-        break;
       case ComponentType::UNSIGNED_BYTE:
-        this->ExecuteBufferDataExtractionWorker<unsigned char, ArrayType, vtkArrayDispatchType>(
+        return this->ExecuteBufferDataExtractionWorker<unsigned char, ArrayType, vtkArrayDispatchType>(
           output, accessor, bufferView);
-        break;
       case ComponentType::SHORT:
-        this->ExecuteBufferDataExtractionWorker<short, ArrayType, vtkArrayDispatchType>(
+        return this->ExecuteBufferDataExtractionWorker<short, ArrayType, vtkArrayDispatchType>(
           output, accessor, bufferView);
-        break;
       case ComponentType::UNSIGNED_SHORT:
-        this->ExecuteBufferDataExtractionWorker<uint16_t, ArrayType, vtkArrayDispatchType>(
+        return this->ExecuteBufferDataExtractionWorker<uint16_t, ArrayType, vtkArrayDispatchType>(
           output, accessor, bufferView);
-        break;
       case ComponentType::UNSIGNED_INT:
-        this->ExecuteBufferDataExtractionWorker<uint32_t, ArrayType, vtkArrayDispatchType>(
+        return this->ExecuteBufferDataExtractionWorker<uint32_t, ArrayType, vtkArrayDispatchType>(
           output, accessor, bufferView);
-        break;
       case ComponentType::FLOAT:
-        this->ExecuteBufferDataExtractionWorker<float, ArrayType, vtkArrayDispatchType>(
+        return this->ExecuteBufferDataExtractionWorker<float, ArrayType, vtkArrayDispatchType>(
           output, accessor, bufferView);
-        break;
       default:
-        return;
+        return false;
     }
   }
 
@@ -354,17 +348,17 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
    * forwarding template types and parameters.
    */
   template <typename ArrayType>
-  void DispatchWorkerExecution(
+  bool DispatchWorkerExecution(
     ArrayType* output, const Accessor& accessor, const BufferView& bufferView)
   {
     if (accessor.Normalized || accessor.ComponentTypeValue == ComponentType::FLOAT)
     {
-      this->DispatchWorkerExecutionByComponentType<ArrayType, vtkArrayDispatch::Reals>(
+      return this->DispatchWorkerExecutionByComponentType<ArrayType, vtkArrayDispatch::Reals>(
         output, accessor, bufferView);
     }
     else
     {
-      this->DispatchWorkerExecutionByComponentType<ArrayType, vtkArrayDispatch::Integrals>(
+      return this->DispatchWorkerExecutionByComponentType<ArrayType, vtkArrayDispatch::Integrals>(
         output, accessor, bufferView);
     }
   }
@@ -373,9 +367,15 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
    * Creates a new BufferDataExtractionWorker, initializes it and starts its execution
    */
   template <typename ComponentType, typename ArrayType, typename vtkArrayDispatchType>
-  void ExecuteBufferDataExtractionWorker(
+  bool ExecuteBufferDataExtractionWorker(
     ArrayType* output, const Accessor& accessor, const BufferView& bufferView)
   {
+    if (bufferView.Buffer < 0 || bufferView.Buffer >= static_cast<int>(this->Buffers->size()))
+    {
+      vtkErrorWithObjectMacro(nullptr, "Invalid buffer index:" << bufferView.Buffer);
+      return false;
+    }
+
     // Create worker
     BufferDataExtractionWorker<ComponentType> worker;
     // Set worker parameters
@@ -390,6 +390,7 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
 
     // Start worker execution
     vtkArrayDispatch::DispatchByValueType<vtkArrayDispatchType>::Execute(output, worker);
+    return true;
   }
 
   void Setup(int accessorId, vtkGLTFDocumentLoader::AccessorType expectedType)
@@ -419,13 +420,18 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
     }
 
     // Load base accessor data
-    if (accessor.BufferView >= 0)
+    if (accessor.BufferView >= 0 &&
+      accessor.BufferView < static_cast<int>(this->BufferViews->size()))
     {
       const BufferView& bufferView = this->BufferViews->operator[](accessor.BufferView);
 
       output->SetNumberOfComponents(GetNumberOfComponentsForType(this->ExpectedType));
 
-      DispatchWorkerExecution<ArrayType>(output, accessor, bufferView);
+      if (!DispatchWorkerExecution<ArrayType>(output, accessor, bufferView))
+      {
+        this->Result = false;
+        return;
+      }
     }
     else if (!accessor.IsSparse)
     {
@@ -457,7 +463,12 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
       mockIndicesAccessor.NumberOfComponents = 1;
       mockIndicesAccessor.ComponentTypeValue = sparse.IndicesComponentType;
 
-      DispatchWorkerExecution<vtkIntArray>(sparseIndices, mockIndicesAccessor, indicesBufferView);
+      if (!DispatchWorkerExecution<vtkIntArray>(
+            sparseIndices, mockIndicesAccessor, indicesBufferView))
+      {
+        this->Result = false;
+        return;
+      }
 
       // Load values
       vtkNew<ArrayType> sparseValues;
@@ -467,8 +478,12 @@ struct vtkGLTFDocumentLoader::AccessorLoadingWorker
       mockValuesAccessor.Count = sparse.Count;
       mockValuesAccessor.ByteOffset = sparse.ValuesByteOffset;
 
-      DispatchWorkerExecution<ArrayType>(
-        sparseValues.GetPointer(), mockValuesAccessor, valuesBufferView);
+      if (!DispatchWorkerExecution<ArrayType>(
+            sparseValues.GetPointer(), mockValuesAccessor, valuesBufferView))
+      {
+        this->Result = false;
+        return;
+      }
 
       // Replace values into original (non sparse) array
       for (int id = 0; id < sparseIndices->GetNumberOfValues(); id++)