From a76c2dd7ed3924954751edf352db7603da319a29 Mon Sep 17 00:00:00 2001 From: Fedor Chelnokov Date: Mon, 7 Sep 2026 22:49:24 +0300 Subject: [PATCH 1/7] Bump OpenCTM to security fix for _ctmStreamReadSTRING heap overflow Points the OpenCTM submodule and the vcpkg overlay port at the fix for a heap-buffer-overflow write reachable from ctmLoad on a crafted .ctm file (32-bit len+1 wrap in _ctmStreamReadSTRING). MeshInspector/OpenCTM#2. Co-Authored-By: Claude Fable 5.1 --- thirdparty/OpenCTM-git | 2 +- thirdparty/vcpkg/ports/openctm/portfile.cmake | 4 ++-- thirdparty/vcpkg/ports/openctm/vcpkg.json | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/thirdparty/OpenCTM-git b/thirdparty/OpenCTM-git index 2b444a4c70c4..beb296897e42 160000 --- a/thirdparty/OpenCTM-git +++ b/thirdparty/OpenCTM-git @@ -1 +1 @@ -Subproject commit 2b444a4c70c432c1f4990fb32b0fcb11d0d81aad +Subproject commit beb296897e42419fabbe19ace1386890f7794499 diff --git a/thirdparty/vcpkg/ports/openctm/portfile.cmake b/thirdparty/vcpkg/ports/openctm/portfile.cmake index d41ac78922e4..347f6102d020 100644 --- a/thirdparty/vcpkg/ports/openctm/portfile.cmake +++ b/thirdparty/vcpkg/ports/openctm/portfile.cmake @@ -1,8 +1,8 @@ vcpkg_from_github( OUT_SOURCE_PATH SOURCE_PATH REPO MeshInspector/OpenCTM - REF 2b444a4c70c432c1f4990fb32b0fcb11d0d81aad - SHA512 36c16d42063dc732c1f47b711ce59395ced425907707190fe80088c0cd30ee83f5348960c7710b8ebeaa2ad0d9e2d928e60f4c5fd652e17559e0f08c72b15fd3 + REF beb296897e42419fabbe19ace1386890f7794499 + SHA512 38d5b56ddf0c5f3c4409b02e97079959ccafacb611b5306789dbce0b0e3ff0ed02e997beec3fa68ed43108cc96d539bf7147618c41c4fbf4460f84170b459428 HEAD_REF master ) diff --git a/thirdparty/vcpkg/ports/openctm/vcpkg.json b/thirdparty/vcpkg/ports/openctm/vcpkg.json index f97d2bef102b..4398766fc6ab 100644 --- a/thirdparty/vcpkg/ports/openctm/vcpkg.json +++ b/thirdparty/vcpkg/ports/openctm/vcpkg.json @@ -1,7 +1,7 @@ { "name": "openctm", "version-string": "1.0.3", - "port-version": 3, + "port-version": 4, "homepage": "https://github.com/MeshInspector/OpenCTM", "description": "OpenCTM is a file format, a software library and a tool set for compression of 3D triangle meshes.", "license": "Zlib", From 9fbef68d5681866d86fbc73d9693fd9c3b49f7fa Mon Sep 17 00:00:00 2001 From: Fedor Chelnokov Date: Tue, 8 Sep 2026 10:18:33 +0300 Subject: [PATCH 2/7] Bump OpenCTM to 838a510: reset stale error, clear mesh on rejected header, stop parsing after a failure --- thirdparty/OpenCTM-git | 2 +- thirdparty/vcpkg/ports/openctm/portfile.cmake | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/thirdparty/OpenCTM-git b/thirdparty/OpenCTM-git index beb296897e42..838a510daac2 160000 --- a/thirdparty/OpenCTM-git +++ b/thirdparty/OpenCTM-git @@ -1 +1 @@ -Subproject commit beb296897e42419fabbe19ace1386890f7794499 +Subproject commit 838a510daac28af2f2660f9215d580cbb341cee8 diff --git a/thirdparty/vcpkg/ports/openctm/portfile.cmake b/thirdparty/vcpkg/ports/openctm/portfile.cmake index 347f6102d020..5385608c1845 100644 --- a/thirdparty/vcpkg/ports/openctm/portfile.cmake +++ b/thirdparty/vcpkg/ports/openctm/portfile.cmake @@ -1,8 +1,8 @@ vcpkg_from_github( OUT_SOURCE_PATH SOURCE_PATH REPO MeshInspector/OpenCTM - REF beb296897e42419fabbe19ace1386890f7794499 - SHA512 38d5b56ddf0c5f3c4409b02e97079959ccafacb611b5306789dbce0b0e3ff0ed02e997beec3fa68ed43108cc96d539bf7147618c41c4fbf4460f84170b459428 + REF 838a510daac28af2f2660f9215d580cbb341cee8 + SHA512 c1a19c797bb815d26096c14be200479b851328f82b595ab871299af10b93c68b93634e6ad87b2bdd2ee5a9b468ef955a2af27a158ab7a48bf32c70a3851f63aa HEAD_REF master ) From 1febf3e63ce51b471fae18be92eadb3ab54eaebf Mon Sep 17 00:00:00 2001 From: Fedor Chelnokov Date: Tue, 8 Sep 2026 10:18:37 +0300 Subject: [PATCH 3/7] Re-pin OpenCTM in the third-party license manifest (LICENSE text unchanged) --- thirdparty/licenses/manifest.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/thirdparty/licenses/manifest.json b/thirdparty/licenses/manifest.json index f08f0c2de2cc..b935af04ed3e 100644 --- a/thirdparty/licenses/manifest.json +++ b/thirdparty/licenses/manifest.json @@ -315,7 +315,7 @@ "type": "submodule", "path": "thirdparty/OpenCTM-git" }, - "version": "2b444a4c70c432c1f4990fb32b0fcb11d0d81aad" + "version": "838a510daac28af2f2660f9215d580cbb341cee8" }, { "id": "LAZperf", From b6072b485873a01f31bd336c7eafe52e0154cc38 Mon Sep 17 00:00:00 2001 From: Fedor Chelnokov Date: Tue, 8 Sep 2026 11:11:24 +0300 Subject: [PATCH 4/7] Re-point OpenCTM to squashed master commit 32135dbc7aa1239fca8dff1849bfca9c21d0342e --- thirdparty/OpenCTM-git | 2 +- thirdparty/vcpkg/ports/openctm/portfile.cmake | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/thirdparty/OpenCTM-git b/thirdparty/OpenCTM-git index 838a510daac2..32135dbc7aa1 160000 --- a/thirdparty/OpenCTM-git +++ b/thirdparty/OpenCTM-git @@ -1 +1 @@ -Subproject commit 838a510daac28af2f2660f9215d580cbb341cee8 +Subproject commit 32135dbc7aa1239fca8dff1849bfca9c21d0342e diff --git a/thirdparty/vcpkg/ports/openctm/portfile.cmake b/thirdparty/vcpkg/ports/openctm/portfile.cmake index 5385608c1845..e4b47fbce58b 100644 --- a/thirdparty/vcpkg/ports/openctm/portfile.cmake +++ b/thirdparty/vcpkg/ports/openctm/portfile.cmake @@ -1,8 +1,8 @@ vcpkg_from_github( OUT_SOURCE_PATH SOURCE_PATH REPO MeshInspector/OpenCTM - REF 838a510daac28af2f2660f9215d580cbb341cee8 - SHA512 c1a19c797bb815d26096c14be200479b851328f82b595ab871299af10b93c68b93634e6ad87b2bdd2ee5a9b468ef955a2af27a158ab7a48bf32c70a3851f63aa + REF 32135dbc7aa1239fca8dff1849bfca9c21d0342e + SHA512 174ea24303355e2c04963d83a7fa64c38c0144d9606903fdac3eb16e733ccc6e15ef6795f63aa41c13eaa4494ee26c1392a1ea99b6bffcacf1036b87d30a511f HEAD_REF master ) From 139e3b93a17cdac0b9f6b2d03b7604c6ee45b0bf Mon Sep 17 00:00:00 2001 From: Fedor Chelnokov Date: Tue, 8 Sep 2026 11:11:29 +0300 Subject: [PATCH 5/7] Re-pin OpenCTM in the third-party license manifest --- thirdparty/licenses/manifest.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/thirdparty/licenses/manifest.json b/thirdparty/licenses/manifest.json index b935af04ed3e..f330c0db2886 100644 --- a/thirdparty/licenses/manifest.json +++ b/thirdparty/licenses/manifest.json @@ -315,7 +315,7 @@ "type": "submodule", "path": "thirdparty/OpenCTM-git" }, - "version": "838a510daac28af2f2660f9215d580cbb341cee8" + "version": "32135dbc7aa1239fca8dff1849bfca9c21d0342e" }, { "id": "LAZperf", From 0e4b35ac08e17db32c3f05d0433d6552b676f41f Mon Sep 17 00:00:00 2001 From: Fedor Chelnokov Date: Tue, 8 Sep 2026 12:24:35 +0300 Subject: [PATCH 6/7] Bump OpenCTM to eae87a4d9 (count-overflow fix, OpenCTM#3) in submodule, vcpkg port and CPM lock --- thirdparty/OpenCTM-git | 2 +- thirdparty/cpm/package-lock.cmake | 2 +- thirdparty/vcpkg/ports/openctm/portfile.cmake | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/thirdparty/OpenCTM-git b/thirdparty/OpenCTM-git index 32135dbc7aa1..eae87a4d9ac2 160000 --- a/thirdparty/OpenCTM-git +++ b/thirdparty/OpenCTM-git @@ -1 +1 @@ -Subproject commit 32135dbc7aa1239fca8dff1849bfca9c21d0342e +Subproject commit eae87a4d9ac229bdc7c32492c84bd7cb1329e5c4 diff --git a/thirdparty/cpm/package-lock.cmake b/thirdparty/cpm/package-lock.cmake index 884fd7249f0f..cc7f3e0951fc 100644 --- a/thirdparty/cpm/package-lock.cmake +++ b/thirdparty/cpm/package-lock.cmake @@ -125,7 +125,7 @@ set(MESHLIB_PACKAGE_onetbb set(MESHLIB_PACKAGE_OpenCTM GIT_REPOSITORY https://github.com/MeshInspector/OpenCTM.git - GIT_TAG 2b444a4c70c432c1f4990fb32b0fcb11d0d81aad + GIT_TAG eae87a4d9ac229bdc7c32492c84bd7cb1329e5c4 ) set(MESHLIB_PACKAGE_openvdb diff --git a/thirdparty/vcpkg/ports/openctm/portfile.cmake b/thirdparty/vcpkg/ports/openctm/portfile.cmake index e4b47fbce58b..c9f13cc0f0df 100644 --- a/thirdparty/vcpkg/ports/openctm/portfile.cmake +++ b/thirdparty/vcpkg/ports/openctm/portfile.cmake @@ -1,8 +1,8 @@ vcpkg_from_github( OUT_SOURCE_PATH SOURCE_PATH REPO MeshInspector/OpenCTM - REF 32135dbc7aa1239fca8dff1849bfca9c21d0342e - SHA512 174ea24303355e2c04963d83a7fa64c38c0144d9606903fdac3eb16e733ccc6e15ef6795f63aa41c13eaa4494ee26c1392a1ea99b6bffcacf1036b87d30a511f + REF eae87a4d9ac229bdc7c32492c84bd7cb1329e5c4 + SHA512 0e40fb168ce652e93b8fb7828cb4c34678026028cb03344fa847141a0dac0744bd17f9448464e9d1c35495dde5fd1efcd8b34d554ca31e1a04f9574e4e455bad HEAD_REF master ) From 0d8929b033b9adc64155f30f7ae21b8b339af9c3 Mon Sep 17 00:00:00 2001 From: Fedor Chelnokov Date: Tue, 8 Sep 2026 12:24:52 +0300 Subject: [PATCH 7/7] Re-pin OpenCTM in the third-party license manifest --- thirdparty/licenses/manifest.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/thirdparty/licenses/manifest.json b/thirdparty/licenses/manifest.json index f330c0db2886..a45a88699b98 100644 --- a/thirdparty/licenses/manifest.json +++ b/thirdparty/licenses/manifest.json @@ -315,7 +315,7 @@ "type": "submodule", "path": "thirdparty/OpenCTM-git" }, - "version": "32135dbc7aa1239fca8dff1849bfca9c21d0342e" + "version": "eae87a4d9ac229bdc7c32492c84bd7cb1329e5c4" }, { "id": "LAZperf",