Open Asset Import Library Assimp Heap-Based Buffer Overflow Vulnerability in AC3D File Handler

A critical heap-based buffer overflow vulnerability has been identified in Open Asset Import Library (Assimp) version 5.4.3. The issue arises in the AC3D file handler, specifically within the function 'Assimp::AC3DImporter::ConvertObjectSection' in 'code/AssetLib/AC/ACLoader.cpp'. The vulnerability allows for remote exploitation, potentially leading to arbitrary code execution, by manipulating the 'tmp' argument to overwrite memory boundaries. This flaw was disclosed publicly and is available for exploitation.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by building Assimp with address sanitizer enabled, and then using a crafted AC3D file as input. The provided proof-of-concept demonstrates this exploitation by overwriting memory and triggering the buffer overflow.