CVE-2022-3008 (C, published 2022-09-05T09:15Z)
Description: value: The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/syoyo/tinygltf
Files changed:
tiny_gltf.h
Commit message: Do not expand file path since its not necessary for glTF asset path(URI) and for security reason(`wordexp`).


Vulnerable code:
#define TINYGLTF_COMPONENT_TYPE_DOUBLE (5130) // OpenGL double type. Note that some of glTF 2.0 validator does not support double type even the schema seems allow any value of integer: https://github.com/KhronosGroup/glTF/blob/b9884a2fd45130b4d673dd6c8a706ee21ee5c5f7/specification/2.0/schema/accessor.schema.json#L22
  //int wrapR = TINYGLTF_TEXTURE_WRAP_REPEAT;  // TinyGLTF extension. currently not used.
  /// Set warning message to `warn` for example it fails to load asserts.
  /// Returns false and set error string to `err` if there's an error.
#include <wordexp.h>
         this->wrapS == other.wrapS &&
         this->wrapT == other.wrapT;
         //this->wrapR == other.wrapR
  if (idx != std::string::npos)
    return filepath.substr(idx + 1);
  if (!ParseIntegerProperty(&indices_buffer_view, err, indices_obj, "bufferView",
                       true, "SparseAccessor")) {
                       true, "SparseAccessor")) {
                       true, "SparseAccessor")) {
  //int wrapR = TINYGLTF_TEXTURE_WRAP_REPEAT;
  //ParseIntegerProperty(&wrapR, err, o, "wrapR", false);  // tinygltf extension
  //sampler->wrapR = wrapR;
  //SerializeNumberProperty("wrapR", sampler.wrapR, o);
  const uint32_t content_padding_size = content_size % 4 == 0 ? 0 : 4 - content_size % 4;
  const uint32_t bin_padding_size = binBuffer_size % 4 == 0 ? 0 : 4 - binBuffer_size % 4;

Fixed code:
//  - v2.6.0 Disable expanding file path for security(no use of awkward `wordexp` anymore).
#define TINYGLTF_COMPONENT_TYPE_DOUBLE \
  (5130)  // OpenGL double type. Note that some of glTF 2.0 validator does not
          // support double type even the schema seems allow any value of
          // integer:
          // https://github.com/KhronosGroup/glTF/blob/b9884a2fd45130b4d673dd6c8a706ee21ee5c5f7/specification/2.0/schema/accessor.schema.json#L22
  // int wrapR = TINYGLTF_TEXTURE_WRAP_REPEAT;  // TinyGLTF extension. currently
  // not used.
  /// `base_dir` is a search path of glTF asset(e.g. images). Path Must be an
  /// expanded path (e.g. no tilde(`~`), no environment variables). Set warning
  /// message to `warn` for example it fails to load asserts. Returns false and
  /// set error string to `err` if there's an error.
  /// `base_dir` is a search path of glTF asset(e.g. images). Path Must be an
  /// expanded path (e.g. no tilde(`~`), no environment variables).
//#include <wordexp.h>
         this->wrapS == other.wrapS && this->wrapT == other.wrapT;
  // this->wrapR == other.wrapR
  if (idx != std::string::npos) return filepath.substr(idx + 1);
  // https://github.com/syoyo/tinygltf/issues/368
  //
  // No file path expansion in built-in FS function anymore, since glTF URI
  // should not contain tilde('~') and environment variables, and for security
  // reason(`wordexp`).
  //
  // Users need to supply `base_dir`(in `LoadASCIIFromString`,
  // `LoadBinaryFromMemory`) in expanded absolute path.

  return filepath;

#if 0
#endif
  if (!ParseIntegerProperty(&indices_buffer_view, err, indices_obj,
                            "bufferView", true, "SparseAccessor")) {
                            true, "SparseAccessor")) {
                            true, "SparseAccessor")) {
  // int wrapR = TINYGLTF_TEXTURE_WRAP_REPEAT;
  // ParseIntegerProperty(&wrapR, err, o, "wrapR", false);  // tinygltf
  // extension
  // sampler->wrapR = wrapR;
  // SerializeNumberProperty("wrapR", sampler.wrapR, o);
  const uint32_t content_padding_size =
      content_size % 4 == 0 ? 0 : 4 - content_size % 4;
  const uint32_t bin_padding_size =
      binBuffer_size % 4 == 0 ? 0 : 4 - binBuffer_size % 4;