Compare commits

...

1 Commits

Author SHA1 Message Date
Bruno Postle 1156a5512b IfcParse: don't let a malformed binary token abort the parser
dispatch_token's Token_BINARY branch called TokenFunc::asBinary()
unguarded. A fuzzed file with a stray double-quote inside a numeric
list turns the next token into a 1-character Token_BINARY (e.g. a
lone '"'), which asBinary() rejects by throwing IfcException("Token
is not a valid binary sequence"). Nothing caught it, so it propagated
out of parse_context::construct and aborted the process instead of
producing a validation error.

Wrap the call in the same try/catch pattern already used a few lines
below for Token_ENUMERATION, logging a VAL error instead of crashing.
2026-07-16 22:41:03 +01:00
+5 -1
View File
@@ -61,7 +61,11 @@ namespace {
template <typename Fn>
void dispatch_token(boost::optional<size_t> instance_id, int attribute_id, IfcParse::Token t, IfcParse::declaration* decl, Logger& logger, Fn fn) {
if (t.type == IfcParse::Token_BINARY) {
fn(IfcParse::TokenFunc::asBinary(t));
try {
fn(IfcParse::TokenFunc::asBinary(t));
} catch (IfcParse::IfcException& e) {
logger.Error("VAL", 20, "Invalid binary token at offset " + std::to_string(t.startPos));
}
} else if (IfcParse::TokenFunc::isBool(t)) {
fn(IfcParse::TokenFunc::asBool(t));
} else if (IfcParse::TokenFunc::isLogical(t)) {