realXtend/naali — Issue #343: Ogre crashes on an ill-formed material asset.
Author: juj
Created: 2012-02-04 11:57:07+00:00
State: open
Labels: Bug, Security

If Ogre attempts to load the following material

material foo
{
technique
{
shader_caster_material a_name_that_does_not_exist
pass
{
}
}
}

it crashes. Any user which has entity creation rights and asset upload rights to a trusted storage can add this material to a scene, blocking all users access to the whole scene.

Therefore do not allow users to inject references to new materials on your server, if you need it to be secure.