View Issue Details [ Jump to Notes ] [ Print ]
IDProjectCategoryView StatusDate SubmittedLast Update
0015086VTK(No Category)public2014-10-29 14:292014-11-12 09:40
ReporterStephan Rademacher 
Assigned ToSujin Philip 
PrioritynormalSeverityminorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version5.10.1 
Target VersionFixed in Version6.2.0 
Summary0015086: Buffer Overflow in vtkCubeAxesActor
DescriptionThere are buffer overflows in the AdjustValues method of vtkCubeAxesActor.

In this method local buffers are created on the stack and then filled using sprintf, like this:

char xTitle[64];
..
..
..
sprintf(xTitle, "%s (x10^%d %s)", this->XTitle, xPow, XUnits);

This can overflow easily if the parameters are too long. I realize that one rarely if ever needs more than 64 chars for an axis label, so this won't happen 'in the wild' very often. But well, I ran into it :)

Here is a small program demonstrating the overflow:

#include "vtkCubeAxesActor.h"
#include "vtkRenderer.h"
#include "vtkRenderWindow.h"
#include "vtkRenderWindowInteractor.h"
#include "vtkSmartPointer.h"

int main()
{
    vtkSmartPointer<vtkRenderer> renderer = vtkSmartPointer<vtkRenderer>::New();
    vtkSmartPointer<vtkRenderWindow> renderWindow = vtkSmartPointer<vtkRenderWindow>::New();
    vtkSmartPointer<vtkRenderWindowInteractor> interactor = vtkSmartPointer<vtkRenderWindowInteractor>::New();

    renderWindow->AddRenderer(renderer);
    interactor->SetRenderWindow(renderWindow);

    vtkSmartPointer<vtkCubeAxesActor> axesActor = vtkSmartPointer<vtkCubeAxesActor>::New();
    vtkCamera* camera = renderer->GetActiveCamera();
    axesActor->SetCamera(camera);

    double bounds[6] = {0.0, 16.0, 0.0, 16.0, 0.0, 16.0};
    axesActor->SetBounds(bounds);
    axesActor->SetXTitle("This string is going to be rather long, far far longer than 64 characters! Boomchakalaka!");
    
    renderer->AddActor(axesActor);
    
    renderer->ResetCamera();
    renderer->SetBackground(0.0, 0.0, 0.0);
    
    renderWindow->Render();
    interactor->Start();

    return 0;
}
TagsNo tags attached.
ProjectTBD
Typecrash
Attached Files

 Relationships

  Notes
(0033800)
Sujin Philip (developer)
2014-11-12 09:40

 Please refer to http://review.source.kitware.com/#/t/4951/ [^]

 Issue History
Date Modified Username Field Change
2014-10-29 14:29 Stephan Rademacher New Issue
2014-11-06 16:47 Sujin Philip Assigned To => Sujin Philip
2014-11-06 16:48 Sujin Philip Status backlog => active development
2014-11-12 09:40 Sujin Philip Note Added: 0033800
2014-11-12 09:40 Sujin Philip Status active development => closed
2014-11-12 09:40 Sujin Philip Resolution open => fixed
2014-11-12 09:40 Sujin Philip Fixed in Version => 6.2.0

Copyright © 2000 - 2018 MantisBT Team