Files
alb3e3andKim Kulling ba8f4f4564 Fix out-of-bounds copy of the uv transformation property (#6748)
* Add texture transform tests for the uv transformation property

Covers the regular property and a property whose data is shorter than an
aiUVTransform. The latter trips the ai_assert on master; with asserts
disabled the memcpy reads 20 bytes out of the shorter property.

Export TextureTransformStep so the tests can drive the step directly, as
is already done for the other post-processing steps under test.

Assisted-by: Claude Code (Claude Opus 5)

* Fix out-of-bounds copy of the uv transformation property

TextureTransformStep::Execute() copied five floats through
&info.mTranslation.x, which writes past that member and over the two
following members of the aiUVTransform base - undefined behaviour that a
sanitizer flags as an intra-object overflow (assimp#6733). The size was
also hard-coded to sizeof(float) * 5, so it read the wrong amount when
ai_real is double, and the source length was only checked by an
ai_assert that is compiled out in release builds.

Copy into a complete aiUVTransform of the correct size instead and skip
properties whose data is too short.

Assisted-by: Claude Code (Claude Opus 5)

---------

Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
2026-08-17 14:21:25 +02:00
..