add more havocs to test stl parsing

1 files changed, 19 insertions, 11 deletions

diff --git a/src/stlfile.c b/src/stlfile.c
index 88fc430..10d9006 100644
--- a/src/stlfile.c
+++ b/src/stlfile.c
@@ -203,6 +203,9 @@ parse_file_ascii(struct parseinfo *info, char *buf, size_t len)
 	if (states.count)
 		PARSE_FAIL("Expected keyword, got:\n%.*s...\n", 30, bp);
 
+	bp = skipws(bp);
+	if (*bp) PARSE_FAIL("Extraneous data at end of file\n");
+
 	stack_free(&states);
 	return OK;
 
@@ -215,7 +218,7 @@ int
 parse_file_bin(struct parseinfo *info, char *buf, size_t len)
 {
 	char *bp, *end = buf + len;
-	int i, k, m;
+	int i, k;
 	float v;
 
 	info->type = TYPE_BIN;
@@ -225,11 +228,13 @@ parse_file_bin(struct parseinfo *info, char *buf, size_t len)
 
 	memcpy(info->header, buf, 80);
 
-	if (strlen(buf + 1))
+	if (*buf == '#' && strlen(buf + 1))
 		info->solidname = checkp(strdup(buf + 1));
 
 	bp = buf + 80;
+
 	info->loopcount = le32toh(*(uint32_t*)bp);
+	bp += 4;
 
 	if (!info->loopcount) {
 		memset(info->bbmax, 0, sizeof(float) * 3);
@@ -245,17 +250,20 @@ parse_file_bin(struct parseinfo *info, char *buf, size_t len)
 	for (i = 0; i < info->loopcount; i++) {
 		if (bp + 50 > end)
 			PARSE_FAIL("Truncated data! (loops missing)\n");
-		bp += 12;
-		for (k = 0; k < 3; k++, bp += 12) {
-			for (m = 0; m < 3; m++) {
-				v = fle32toh(*(float*)(bp + 4 * m));
-				info->bbmin[m] = MIN(info->bbmin[m], v);
-				info->bbmax[m] = MAX(info->bbmax[m], v);
+		for (k = 0; k < 12; k++, bp += 4) {
+			v = fle32toh(*(float*)bp);
+			if (v == INFINITY || v == NAN)
+				PARSE_FAIL("Encountered invalid float\n");
+			if (k >= 3) {
+				info->bbmin[k % 3] = MIN(info->bbmin[k % 3], v);
+				info->bbmax[k % 3] = MAX(info->bbmax[k % 3], v);
 			}
 		}
 		bp += 2;
 	}
 
+	if (bp != end) PARSE_FAIL("Extraneous data at end of file\n");
+
 	return OK;
 
 fail:
@@ -271,8 +279,8 @@ parse_file(struct parseinfo *info, char *buf, size_t len)
 
 	if (info->valid) free_info(info);
 
-	if (len < 7) {
-		fprintf(stderr, "File too small!\n");
+	if (len < 10) {
+		fprintf(stderr, "ERR: File too small!\n");
 		return FAIL;
 	}
 
@@ -290,7 +298,7 @@ parse_file(struct parseinfo *info, char *buf, size_t len)
 	if (!info->modelname) {
 		resp = ask("Please enter your model name: ");
 		if (strlen(resp) < 4) {
-			fprintf(stderr, "Model name is too short!\n");
+			fprintf(stderr, "ERR: Model name is too short!\n");
 			return FAIL;
 		}
 		info->modelname = checkp(strdup(resp));