Invalid-free in igl::MshLoader::~MshLoader in libigl
Summary
OSV-2022-360: Invalid-free in igl::MshLoader::~MshLoader. Affects libigl versions >= e91fb2b9e071c4a54a2c53c405affff9510fffdf. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libigl is an open-source C++ library for geometry processing that provides a wide range of functionality for working with 3D models. It offers various algorithms and data structures for tasks such as mesh manipulation, shape analysis, and visualization. The library is widely used in the computer graphics and computational geometry communities. However, a vulnerability has been discovered in the MshLoader class destructor, which can lead to an invalid-free issue.
Vulnerability Detail
The vulnerability in libigl's MshLoader class destructor arises from an invalid-free operation. When the destructor is called, it attempts to free memory that has already been freed, resulting in undefined behavior. This can potentially lead to crashes or other security issues. The vulnerability was reported through the OSS-Fuzz project, and the crash state indicates that the issue occurs in the igl_fuzzer.cpp file.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As of now, there is no specific workaround provided for this vulnerability. Developers are advised to apply the fix mentioned above as soon as it becomes available.
Conclusion
In conclusion, libigl is affected by a vulnerability in the MshLoader class destructor, which can result in crashes or other security issues. Developers should apply the recommended fix to address this vulnerability and ensure proper memory management. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libigl →
FAQ
libigl is an open-source C++ library for geometry processing that provides various algorithms and data structures for tasks such as mesh manipulation, shape analysis, and visualization.
The vulnerability can lead to crashes or other security issues when the MshLoader class destructor is called, due to an invalid-free operation.
The vulnerability was reported through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
Currently, no specific workaround has been provided. It is recommended to apply the fix once it becomes available.
Developers should review and modify the MshLoader class destructor to ensure proper memory management, avoiding invalid-free operations. Thorough testing should be conducted to verify the fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for libigl.
