RadientGLTFConverter.cpp calls the recursive CreateNode() implementation. It has no cycle check and no depth limit. A malformed cyclic imported graph can therefore recurse indefinitely. An extremely deep, otherwise valid graph can overflow the thread stack.
Recommended fix
Perform graph validation before scheduling any mesh work:
enum class VisitState : Uint8
{
Unvisited,
Visiting,
Complete
};
For every child edge:
- validate the child index,
- increment and validate its parent count,
- reject an edge to a Visiting node,
- allow a Complete node only when it is being referenced by another scene as the same root, not by a second parent.
For scene-less documents, synthesize a scene from nodes whose parent count is zero, not from every node.
Instantiate iteratively using an explicit stack:
struct NodeWork
{
Uint32 NodeIndex;
RadientEntityID Parent;
};
That removes recursion depth as an input-controlled resource.
RadientGLTFConverter.cpp calls the recursive
CreateNode()implementation. It has no cycle check and no depth limit. A malformed cyclic imported graph can therefore recurse indefinitely. An extremely deep, otherwise valid graph can overflow the thread stack.Recommended fix
Perform graph validation before scheduling any mesh work:
For every child edge:
For scene-less documents, synthesize a scene from nodes whose parent count is zero, not from every node.
Instantiate iteratively using an explicit stack:
That removes recursion depth as an input-controlled resource.