repro_iqm.c

/*
 * repro_iqm.c - Standalone reproducer for LoadIQM() vulnerabilities
 *
 * Demonstrates heap buffer overflow in raylib's IQM model parser.
 * Extracts the core parsing logic from rmodels.c LoadIQM() without
 * requiring a full raylib build.
 *
 * Build:
 *   clang -g -O1 -fsanitize=address,undefined repro_iqm.c -o repro_iqm
 *
 * Usage:
 *   ./repro_iqm <crash_file.iqm>
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define IQM_MAGIC        "INTERQUAKEMODEL"
#define IQM_VERSION      2
#define BONE_NAME_LENGTH    32
#define MESH_NAME_LENGTH    32
#define MATERIAL_NAME_LENGTH 32

/* IQM structs copied from rmodels.c */

typedef struct {
    char magic[16];
    unsigned int version;
    unsigned int dataSize;
    unsigned int flags;
    unsigned int num_text, ofs_text;
    unsigned int num_meshes, ofs_meshes;
    unsigned int num_vertexarrays, num_vertexes, ofs_vertexarrays;
    unsigned int num_triangles, ofs_triangles, ofs_adjacency;
    unsigned int num_joints, ofs_joints;
    unsigned int num_poses, ofs_poses;
    unsigned int num_anims, ofs_anims;
    unsigned int num_frames, num_framechannels, ofs_frames, ofs_bounds;
    unsigned int num_comment, ofs_comment;
    unsigned int num_extensions, ofs_extensions;
} IQMHeader;

typedef struct {
    unsigned int name;
    unsigned int material;
    unsigned int first_vertex, num_vertexes;
    unsigned int first_triangle, num_triangles;
} IQMMesh;

typedef struct {
    unsigned int vertex[3];
} IQMTriangle;

typedef struct {
    unsigned int name;
    int parent;
    float translate[3], rotate[4], scale[3];
} IQMJoint;

typedef struct {
    unsigned int type;
    unsigned int flags;
    unsigned int format;
    unsigned int size;
    unsigned int offset;
} IQMVertexArray;

enum {
    IQM_POSITION     = 0,
    IQM_TEXCOORD     = 1,
    IQM_NORMAL       = 2,
    IQM_TANGENT      = 3,
    IQM_BLENDINDEXES = 4,
    IQM_BLENDWEIGHTS = 5,
    IQM_COLOR        = 6,
};

int main(int argc, char *argv[])
{
    if (argc < 2) {
        fprintf(stderr, "Usage: %s <crash_file.iqm>\n", argv[0]);
        return 1;
    }

    FILE *f = fopen(argv[1], "rb");
    if (!f) { perror("fopen"); return 1; }
    fseek(f, 0, SEEK_END);
    int dataSize = (int)ftell(f);
    fseek(f, 0, SEEK_SET);

    unsigned char *fileData = (unsigned char *)malloc(dataSize);
    if (!fileData) { fclose(f); return 1; }
    fread(fileData, 1, dataSize, f);
    fclose(f);

    if (dataSize < (int)sizeof(IQMHeader)) {
        fprintf(stderr, "File too small for IQM header\n");
        free(fileData);
        return 1;
    }

    IQMHeader *hdr = (IQMHeader *)fileData;

    if (memcmp(hdr->magic, IQM_MAGIC, sizeof(IQM_MAGIC)) != 0) {
        fprintf(stderr, "Bad IQM magic\n");
        free(fileData);
        return 1;
    }
    if (hdr->version != IQM_VERSION) {
        fprintf(stderr, "Bad IQM version: %u\n", hdr->version);
        free(fileData);
        return 1;
    }

    printf("IQM header: meshes=%u triangles=%u vertexes=%u joints=%u\n",
           hdr->num_meshes, hdr->num_triangles, hdr->num_vertexes, hdr->num_joints);

    /* Mesh data — mirrors rmodels.c:4785-4808 */
    IQMMesh *imesh = NULL;
    if (hdr->num_meshes > 0) {
        imesh = (IQMMesh *)malloc(hdr->num_meshes * sizeof(IQMMesh));
        if (imesh) {
            memcpy(imesh, fileData + hdr->ofs_meshes,
                   hdr->num_meshes * sizeof(IQMMesh));

            for (unsigned int i = 0; i < hdr->num_meshes; i++) {
                char name[MESH_NAME_LENGTH] = { 0 };
                memcpy(name, fileData + hdr->ofs_text + imesh[i].name,
                       MESH_NAME_LENGTH);

                char material[MATERIAL_NAME_LENGTH] = { 0 };
                memcpy(material, fileData + hdr->ofs_text + imesh[i].material,
                       MATERIAL_NAME_LENGTH);
            }
        }
    }

    /* Triangle data — mirrors rmodels.c:4838-4841 */
    IQMTriangle *tri = NULL;
    if (hdr->num_triangles > 0) {
        tri = (IQMTriangle *)malloc(hdr->num_triangles * sizeof(IQMTriangle));
        if (tri) {
            memcpy(tri, fileData + hdr->ofs_triangles,
                   hdr->num_triangles * sizeof(IQMTriangle));
        }
    }

    /* Vertex array data — mirrors rmodels.c:4860-4976 */
    IQMVertexArray *va = NULL;
    if (hdr->num_vertexarrays > 0) {
        va = (IQMVertexArray *)malloc(hdr->num_vertexarrays * sizeof(IQMVertexArray));
        if (va) {
            memcpy(va, fileData + hdr->ofs_vertexarrays,
                   hdr->num_vertexarrays * sizeof(IQMVertexArray));

            for (unsigned int i = 0; i < hdr->num_vertexarrays; i++) {
                size_t elem_size = 0;
                switch (va[i].type) {
                    case IQM_POSITION:     elem_size = 3 * sizeof(float); break;
                    case IQM_NORMAL:       elem_size = 3 * sizeof(float); break;
                    case IQM_TEXCOORD:     elem_size = 2 * sizeof(float); break;
                    case IQM_TANGENT:      elem_size = 4 * sizeof(float); break;
                    case IQM_BLENDINDEXES: elem_size = 4 * sizeof(char);  break;
                    case IQM_BLENDWEIGHTS: elem_size = 4 * sizeof(unsigned char); break;
                    case IQM_COLOR:        elem_size = 4 * sizeof(unsigned char); break;
                    default: continue;
                }

                void *vdata = malloc(hdr->num_vertexes * elem_size);
                if (vdata) {
                    memcpy(vdata, fileData + va[i].offset,
                           hdr->num_vertexes * elem_size);
                    free(vdata);
                }
            }
        }
    }

    /* Joint data — mirrors rmodels.c:4979-4994 */
    IQMJoint *ijoint = NULL;
    if (hdr->num_joints > 0) {
        ijoint = (IQMJoint *)malloc(hdr->num_joints * sizeof(IQMJoint));
        if (ijoint) {
            memcpy(ijoint, fileData + hdr->ofs_joints,
                   hdr->num_joints * sizeof(IQMJoint));

            for (unsigned int i = 0; i < hdr->num_joints; i++) {
                char name[BONE_NAME_LENGTH] = { 0 };
                memcpy(name, fileData + hdr->ofs_text + ijoint[i].name,
                       BONE_NAME_LENGTH);
            }
        }
    }

    printf("Parsing complete (if you see this without ASAN errors, no crash)\n");

    free(ijoint);
    free(va);
    free(tri);
    free(imesh);
    free(fileData);
    return 0;
}