The MSVC fallback path in safeAddToBufferSize() performed unchecked
arithmetic (type_size*nr*nc) on attacker-controlled values read from
.mjb binary model files. This could cause integer overflow, leading
to an undersized heap allocation followed by a heap buffer overflow
when data is copied into the buffer.
The fix adds manual overflow detection using SIZE_MAX/INTPTR_MAX
comparisons, matching the behavior of the existing __builtin_*_overflow
path used on GCC/Clang.
Also adds a regression test that crafts a binary model buffer with
overflow-inducing size fields and asserts safe rejection.
This functionality is meant for fast copying of `mjModel` when synchronizing the visualization state, as in the Python passive viewer.
PiperOrigin-RevId: 699199743
Change-Id: I13a5160063eb09139ec1aee9c4969bc1c6f547f1
An upcoming LLVM update is due to make this test fail under msan, since msan touches most of the memory allocated for the mjData arena. This causes an OOM failure on memory-limited testing infrastructure.
An 8G allocation is sufficient to catch errors that arise from the use of 32-bit integers to handle sizes.
PiperOrigin-RevId: 640504620
Change-Id: Ia1949b04a1428f01e1075e26b421facb3babedb6
1) protect mj_arenaAllocBytes with mutexes
2) create shards for each thread in the stack and update mj_stackAllocBytes to allocate memory within each shard for a given thread
PiperOrigin-RevId: 568315726
Change-Id: I0dee6694f2a5200fa4df22ade0e68dfaebf637fc
Also add asan instrumentation to detect stack frame leakages (i.e. `mj_markStack` without a corresponding `mj_freeStack` in the same caller function).
PiperOrigin-RevId: 562625645
Change-Id: I4e3ff66ca0b9d08ed0a95cef45393db8e3053e22
- `distance` constraints were not very useful and increased the contact buffer within the constraint solver, violating a core design principle. Therefore they have been removed.
- The enum value `mjEQ_DISTANCE` is retained, but errors will be thrown in the parser and engine if these constraints are selected.
PiperOrigin-RevId: 467050101
Change-Id: Ie72a07e4fe338eea5107004a9fc0f5e47eb0c3b7
The MSVC build on GH Actions doesn't detect overflows in mjData or mjModel sizes, so use a negative size instead to trigger an intentional failure in the test.
PiperOrigin-RevId: 465529615
Change-Id: Ic7f15eed782cdda11b29984b136ed4f625418cc8
While creating an mjData, any error triggers mj_deleteData. If buffer or stack is not NULL at that point, an uninitialized pointer will be freed.
PiperOrigin-RevId: 465378329
Change-Id: I9be0eef0648e05e3e5f1361da346a5046485cde7
Indiscriminate memset into d->buffer and m->buffer previously caused msan to not detect uninitialized reads.
Also fix tests with uninitialized read bugs that are detected by msan after this change.
PiperOrigin-RevId: 451508224
Change-Id: I1f4b080a8ef765c34ba7a0adc2c686419f6e5516
Copybara-Service