From 1156a5512b4b8f645f853eca7f0893d05da06ec1 Mon Sep 17 00:00:00 2001 From: Bruno Postle Date: Thu, 16 Jul 2026 22:41:03 +0100 Subject: [PATCH] IfcParse: don't let a malformed binary token abort the parser dispatch_token's Token_BINARY branch called TokenFunc::asBinary() unguarded. A fuzzed file with a stray double-quote inside a numeric list turns the next token into a 1-character Token_BINARY (e.g. a lone '"'), which asBinary() rejects by throwing IfcException("Token is not a valid binary sequence"). Nothing caught it, so it propagated out of parse_context::construct and aborted the process instead of producing a validation error. Wrap the call in the same try/catch pattern already used a few lines below for Token_ENUMERATION, logging a VAL error instead of crashing. --- src/ifcparse/IfcFile.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/ifcparse/IfcFile.cpp b/src/ifcparse/IfcFile.cpp index 9f938ad41d..8a1af9a587 100644 --- a/src/ifcparse/IfcFile.cpp +++ b/src/ifcparse/IfcFile.cpp @@ -61,7 +61,11 @@ namespace { template void dispatch_token(boost::optional instance_id, int attribute_id, IfcParse::Token t, IfcParse::declaration* decl, Logger& logger, Fn fn) { if (t.type == IfcParse::Token_BINARY) { - fn(IfcParse::TokenFunc::asBinary(t)); + try { + fn(IfcParse::TokenFunc::asBinary(t)); + } catch (IfcParse::IfcException& e) { + logger.Error("VAL", 20, "Invalid binary token at offset " + std::to_string(t.startPos)); + } } else if (IfcParse::TokenFunc::isBool(t)) { fn(IfcParse::TokenFunc::asBool(t)); } else if (IfcParse::TokenFunc::isLogical(t)) {