mirror of
https://github.com/IfcOpenShell/IfcOpenShell.git
synced 2026-08-12 10:33:20 +00:00
IfcParse: don't let a malformed binary token abort the parser
dispatch_token's Token_BINARY branch called TokenFunc::asBinary()
unguarded. A fuzzed file with a stray double-quote inside a numeric
list turns the next token into a 1-character Token_BINARY (e.g. a
lone '"'), which asBinary() rejects by throwing IfcException("Token
is not a valid binary sequence"). Nothing caught it, so it propagated
out of parse_context::construct and aborted the process instead of
producing a validation error.
Wrap the call in the same try/catch pattern already used a few lines
below for Token_ENUMERATION, logging a VAL error instead of crashing.
This commit is contained in:
@@ -61,7 +61,11 @@ namespace {
|
||||
template <typename Fn>
|
||||
void dispatch_token(boost::optional<size_t> instance_id, int attribute_id, IfcParse::Token t, IfcParse::declaration* decl, Logger& logger, Fn fn) {
|
||||
if (t.type == IfcParse::Token_BINARY) {
|
||||
fn(IfcParse::TokenFunc::asBinary(t));
|
||||
try {
|
||||
fn(IfcParse::TokenFunc::asBinary(t));
|
||||
} catch (IfcParse::IfcException& e) {
|
||||
logger.Error("VAL", 20, "Invalid binary token at offset " + std::to_string(t.startPos));
|
||||
}
|
||||
} else if (IfcParse::TokenFunc::isBool(t)) {
|
||||
fn(IfcParse::TokenFunc::asBool(t));
|
||||
} else if (IfcParse::TokenFunc::isLogical(t)) {
|
||||
|
||||
Reference in New Issue
Block a user