Catcrafts/Crafter.Asset
Watch
2
0
Fork
You've already forked Crafter.Asset
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(glb): the code review's findings, and morph targets

Browse source 
Images (Crafter.Asset:Texture):
- LoadPNGFromMemory reads an image's size from its header before decoding
  and refuses more than 65535 a side or 2^28 pixels: stb's 16-bit PNG path
  sized its buffer in 32 bits and overflowed the heap from 2^29. LoadPNG
  reads its file and goes the same way. SizeFromMemory is public.
- A failure stb gives no reason for no longer passes NULL to std::string,
  and the reason is cleared before each decode, so it is never an older one.
- LoadPNG throws std::runtime_error for a file that doesn't load, which
  crafter-build's try/catch reports per file; without exceptions it is Fatal.

Bounds (Crafter.Asset:GLB):
- Load takes an optional decodeLimit, by default 1 GiB plus 64 bytes for
  each byte of the file. Vertices, indices and pixels are paid for before
  they are allocated, so primitives or images naming the same data can't
  exhaust memory.
- extras are written without recursion: deep nesting overflowed the stack.
- The skinned-joint check is O(vertices + nodes), not O(nodes x vertices).
- Load(path) reads the 12-byte header before the rest, and says why a path
  doesn't open.
- Chunk arithmetic is in 32 bits, as the header's is, ordered so that it
  can't wrap round.

Correctness:
- Indices are range-checked before they are narrowed to 32 bits, and whole
  numbers written as 24.0 read as integers.
- Missing tangents come from the UV set the normal texture samples, and a
  zero normal no longer makes them NaN.
- A file that requires an extension the loader doesn't implement is an
  error.
- Only PNG and JPEG are decoded; other formats (WebP, KTX2) stay empty, and
  no texture may use one. An image repeating another's bufferView is copied.
- Strips and fans become lists; points and lines come back empty.
- texCoord is 0 or 1, and every primitive whose material samples it has it.
- JOINTS_n and WEIGHTS_n pair up, the four heaviest influences are kept, a
  vertex without weight goes to its first joint, and a skinned node's mesh
  has joints in every primitive.
- The default scene exists, and its roots are distinct root nodes.
- Sampler enums are glTF's.

New:
- TEXCOORD_1, as uv1.
- Morph targets with the mesh's and nodes' weights; sparse accessors and
  ones without a bufferView; the meshes' extras; the BIN chunk.
- Images are TextureAsset<Vector<std::uint8_t, 4, 4>>; GlbRGBA8 is gone.

Tests: each of the above. The deep chain is timed against one a quarter as
deep instead of a 2 s clock, which flaked in debug builds; the byteStride
and chunk-length tests now fail when the check they test is removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Jorijn van der Graaf 2026-10-31 03:25:12 +01:00
commit fbf3e7fc2e
Signed by: jorijnvdgraaf
GPG key ID: 2937E59CDCC1BCFB
4 changed files with 1468 additions and 400 deletions
Download patch file Download diff file Expand all files Collapse all files

87
interfaces/Crafter.Asset-GLB.cppm
View file

@ -8,22 +8,24 @@ import Crafter.Math;
namespace fs = std::filesystem;
// glTF 2.0 binary (.glb) loading: the node hierarchy, every mesh's
// triangle primitives with their vertex streams, skins, materials, textures
// and decoded images, cameras, and the lights of KHR_lights_punctual. The JSON
// chunk stays available as text, for the extensions this loader doesn't
// interpret (VRMC_springBone, ...), and so do the `extras` of the scene,
// nodes, materials and lights (Blender writes custom properties there);
// parsing those is the caller's business, which keeps the JSON library out of
// this interface and out of everything that imports Crafter.Asset.
// triangle primitives with their vertex streams and morph targets, skins,
// materials, textures and decoded images, cameras, and the lights of
// KHR_lights_punctual. The JSON and BIN chunks stay available, for what this
// loader doesn't interpret (animations, VRMC_springBone, ...), and so do the
// `extras` of the scene, nodes, meshes, materials and lights (Blender writes
// custom properties there); parsing those is the caller's business, which
// keeps the JSON library out of this interface and out of everything that
// imports Crafter.Asset.
//
// Errors in the file come back as the error of the std::expected rather than
// through Compression::Fatal: a GLB is user content, and a bad one shouldn't
// take the program down.
// take the program down. A file that requires an extension this loader
// doesn't implement is an error too, as glTF asks, and so is one that would
// decode to more than Load's decode limit: a few bytes of JSON can point a
// thousand primitives or images at the same data. Running out of memory
// short of the limit isn't an error in the file; it throws std::bad_alloc,
// as it would anywhere else.
export namespace Crafter {
struct GlbRGBA8 {
std::uint8_t r, g, b, a;
};
struct GlbNode {
std::string name;
std::int32_t parent = -1;
@ -41,6 +43,9 @@ export namespace Crafter {
std::int32_t camera = -1;
// A light of KHR_lights_punctual: GlbAsset::lights.
std::int32_t light = -1;
// Its mesh's morph target weights, for this node: one per target, or
// empty to keep the mesh's.
std::vector<float> weights;
// The node's extras as JSON text, or empty.
std::string extras;
};
@ -84,27 +89,53 @@ export namespace Crafter {
std::string extras;
};
// What a morph target adds to each vertex of its primitive, times the
// target's weight. Streams the target doesn't move stay empty.
struct GlbMorphTarget {
std::vector<Vector<float, 3, 3>> positions;
std::vector<Vector<float, 3, 3>> normals;
// Added to the tangents' xyz; the handedness in w stays.
std::vector<Vector<float, 3, 3>> tangents;
};
// One triangle list. Streams the primitive doesn't have stay empty;
// otherwise each has one entry per vertex.
// otherwise each has one entry per vertex. Strips and fans come back as
// lists. Points and lines aren't read: their primitives come back with no
// vertices, so the rest keep the file's numbering.
struct GlbPrimitive {
std::vector<Vector<float, 3, 3>> positions;
std::vector<Vector<float, 3, 3>> normals;
// xyz plus the bitangent's handedness in w. Computed from the UVs when
// the file has none but has normals and TEXCOORD_0.
// xyz plus the bitangent's handedness in w. Where the file has none
// and the primitive has normals, computed from the UV set its
// material's normal texture samples (TEXCOORD_0 without one), as glTF
// asks.
std::vector<Vector<float, 4, 4>> tangents;
std::vector<Vector<float, 2, 2>> uv0;
// TEXCOORD_1: a second UV set, for the textures whose GlbTextureRef
// says texCoord 1.
std::vector<Vector<float, 2, 2>> uv1;
// Up to four joints a vertex, their weights summing to 1. Where the
// file gives more (JOINTS_1 and WEIGHTS_1, ...), the four heaviest,
// a joint named twice counted once; where it gives a vertex no weight
// at all, all of it on the vertex's first joint, as three.js does. A
// slot left over holds joint 0 with weight 0.
std::vector<std::array<std::uint16_t, 4>> joints;
// Normalized to sum to 1, which the file is meant to do and often
// only nearly does.
std::vector<std::array<float, 4>> weights;
// 0..n-1 when the primitive isn't indexed.
std::vector<std::uint32_t> indices;
std::vector<GlbMorphTarget> targets;
std::int32_t material = -1;
};
struct GlbMesh {
std::string name;
std::vector<GlbPrimitive> primitives;
// The weights of the morph targets its primitives share, one per
// target; 0 where the file gives none. A node can override them.
std::vector<float> weights;
// The mesh's extras as JSON text, or empty. Blender and three.js
// write the morph targets' names there, as targetNames.
std::string extras;
};
struct GlbSkin {
@ -124,6 +155,8 @@ export namespace Crafter {
struct GlbTextureRef {
std::int32_t texture = -1;
// The UV set the texture is sampled with: 0 for uv0, 1 for uv1. Every
// primitive whose material samples a set has it.
std::uint32_t texCoord = 0;
// normalTexture's scale or occlusionTexture's strength.
float scale = 1.0f;
@ -155,7 +188,9 @@ export namespace Crafter {
std::string extras;
};
// The OpenGL filter and wrap enums, as in the file; 0 when unspecified.
// The OpenGL filter and wrap enums, as in the file. The filters are 0
// when the file leaves them to the renderer; the wrap modes default to
// REPEAT, 10497, as glTF's do.
struct GlbSampler {
std::uint32_t magFilter = 0;
std::uint32_t minFilter = 0;
@ -177,15 +212,25 @@ export namespace Crafter {
std::vector<GlbMaterial> materials;
std::vector<GlbTexture> textures;
std::vector<GlbSampler> samplers;
std::vector<TextureAsset<GlbRGBA8>> images;
// One per image in the file, in RGBA8. An image in a format other
// than PNG and JPEG (the WebP or KTX2 of EXT_texture_webp or
// KHR_texture_basisu) isn't decoded and stays empty, sizeX 0; no
// texture's image is one.
std::vector<TextureAsset<Vector<std::uint8_t, 4, 4>>> images;
std::vector<GlbCamera> cameras;
std::vector<GlbLight> lights;
// The default scene's extras as JSON text, or empty.
std::string extras;
// The JSON chunk, verbatim.
std::string json;
// The BIN chunk, verbatim: the data of what the JSON describes and
// this loader doesn't read (animations, ...).
std::vector<std::byte> bin;
static std::expected<GlbAsset, std::string> Load(const fs::path& path);
static std::expected<GlbAsset, std::string> Load(std::span<const std::byte> glb);
// What Load decodes (vertices, indices and pixels) is held to
// `decodeLimit` bytes; without one, to 1 GiB plus 64 bytes for each
// byte of the file.
static std::expected<GlbAsset, std::string> Load(const fs::path& path, std::optional<std::uint64_t> decodeLimit = std::nullopt);
static std::expected<GlbAsset, std::string> Load(std::span<const std::byte> glb, std::optional<std::uint64_t> decodeLimit = std::nullopt);
};
}

103
interfaces/Crafter.Asset-Texture.cppm
View file

@ -6,6 +6,12 @@ module;
#include "../lib/stb_image.h"
#define STB_IMAGE_RESIZE_IMPLEMENTATION
#include "../lib/stb_image_resize2.h"
// stb keeps the reason for its last failure until the next one, and a few
// of its failures give none: cleared before each decode, the reason after a
// failure is that failure's or null, never an older one's.
void CrafterAssetClearStbiFailure() {
stbi__g_failure_reason = nullptr;
}
export module Crafter.Asset:Texture;
import :Compression;
import std;
@ -143,51 +149,110 @@ export namespace Crafter {
file.read(reinterpret_cast<char*>(pixels), sizeX * sizeY * sizeof(T));
}
// Decodes anything stb_image reads (PNG, JPEG, ...) to 8-bit RGBA, or
// to normalized floats when TT is a floating-point component type.
// Decodes anything stb_image reads (PNG, JPEG, TGA, BMP, ...) to 8-bit
// RGBA, or to normalized floats when TT is a floating-point component
// type. A file that doesn't decode throws std::runtime_error, which
// callers such as crafter-build catch to report the file; built
// without exceptions (wasm), there is nothing to catch, and it is
// Fatal.
template <typename TT>
static TextureAsset<T> LoadPNG(fs::path path) {
std::filesystem::path abs = std::filesystem::absolute(path);
int sizeX;
int sizeY;
unsigned char* data = stbi_load(abs.string().c_str(), &sizeX, &sizeY, nullptr, 4);
if (data == nullptr) {
Compression::Fatal(std::format("LoadPNG: {}: {}", abs.string(), stbi_failure_reason()));
// Read whole and decoded from memory, so that the size checked
// before decoding is the size of the bytes that are decoded.
std::error_code error;
if (!fs::is_regular_file(abs, error)) {
Fail(std::format("LoadPNG: {}: {}", abs.string(), error ? error.message() : "not a file"));
}
if (!FitsSize(sizeX, sizeY)) {
stbi_image_free(data);
Compression::Fatal(std::format("LoadPNG: {}: {}x{} is more than a texture's 65535 a side", abs.string(), sizeX, sizeY));
const std::uintmax_t size = fs::file_size(abs, error);
if (error) Fail(std::format("LoadPNG: {}: {}", abs.string(), error.message()));
if (size > kMaxEncoded) Fail(std::format("LoadPNG: {}: {} bytes is more than stb_image reads", abs.string(), size));
std::vector<std::byte> encoded(static_cast<std::size_t>(size));
std::ifstream file(abs, std::ios::binary);
if (!file.read(reinterpret_cast<char*>(encoded.data()), static_cast<std::streamsize>(encoded.size()))) {
Fail(std::format("LoadPNG: {}: can't read it", abs.string()));
}
return FromRGBA8<TT>(data, sizeX, sizeY);
std::expected<TextureAsset<T>, std::string> tex = LoadPNGFromMemory<TT>(encoded);
if (!tex) Fail(std::format("LoadPNG: {}: {}", abs.string(), tex.error()));
return std::move(*tex);
}
// LoadPNG from an image that is already in memory, e.g. one embedded
// in a GLB. An image that doesn't decode comes back as an error value
// rather than a Fatal: the caller is reading a larger asset and can
// say which part was bad.
// rather than an exception or a Fatal: the caller is reading a larger
// asset and can say which part was bad. One too large for a texture
// is turned down from its header, before anything is decoded.
template <typename TT>
static std::expected<TextureAsset<T>, std::string> LoadPNGFromMemory(std::span<const std::byte> encoded) {
const auto size = SizeFromMemory(encoded);
if (!size) return std::unexpected(size.error());
int sizeX;
int sizeY;
CrafterAssetClearStbiFailure();
unsigned char* data = stbi_load_from_memory(reinterpret_cast<const stbi_uc*>(encoded.data()),
static_cast<int>(encoded.size()), &sizeX, &sizeY, nullptr, 4);
if (data == nullptr) {
return std::unexpected(std::string(stbi_failure_reason()));
return std::unexpected(FailureReason());
}
if (!FitsSize(sizeX, sizeY)) {
stbi_image_free(data);
return std::unexpected(std::format("{}x{} is more than a texture's 65535 a side", sizeX, sizeY));
return std::unexpected(std::format("{}x{} decoded from a header of {}x{}", sizeX, sizeY, size->first, size->second));
}
return FromRGBA8<TT>(data, sizeX, sizeY);
}
// The width and height LoadPNGFromMemory would decode an image to,
// read from its header alone, or why it wouldn't: an image it can't
// read, or one too large for a texture.
static std::expected<std::pair<std::uint32_t, std::uint32_t>, std::string> SizeFromMemory(std::span<const std::byte> encoded) {
if (encoded.size() > kMaxEncoded) {
return std::unexpected(std::format("{} bytes is more than stb_image reads", encoded.size()));
}
int sizeX;
int sizeY;
int components;
CrafterAssetClearStbiFailure();
if (!stbi_info_from_memory(reinterpret_cast<const stbi_uc*>(encoded.data()), static_cast<int>(encoded.size()),
&sizeX, &sizeY, &components)) {
return std::unexpected(FailureReason());
}
if (!FitsSize(sizeX, sizeY)) {
return std::unexpected(std::format("{}x{} is more than a texture takes: 65535 a side, {} pixels in all", sizeX, sizeY, kMaxPixels));
}
return std::pair<std::uint32_t, std::uint32_t>(sizeX, sizeY);
}
private:
// sizeX and sizeY hold 16 bits.
static bool FitsSize(int sizeX, int sizeY) {
return sizeX <= std::numeric_limits<std::uint16_t>::max() && sizeY <= std::numeric_limits<std::uint16_t>::max();
// stb_image takes an encoded image's length as an int.
static constexpr std::uintmax_t kMaxEncoded = std::numeric_limits<int>::max();
// sizeX and sizeY hold 16 bits, and stb_image's arithmetic 32: its
// 16-bit PNG decoding sizes a buffer of 8 bytes a pixel in an
// unsigned int, which wraps round from 2^29 pixels. 2^28 is
// 16384x16384, 1 GiB of RGBA8.
static constexpr std::uint64_t kMaxPixels = std::uint64_t{1} << 28;
static bool FitsSize(std::uint64_t sizeX, std::uint64_t sizeY) {
return sizeX <= std::numeric_limits<std::uint16_t>::max() && sizeY <= std::numeric_limits<std::uint16_t>::max()
&& sizeX * sizeY <= kMaxPixels;
}
// stb_image's reason for the failure just now. CrafterAssetClearStbiFailure
// before the call makes it this failure's, but some failures give
// none.
static std::string FailureReason() {
const char* reason = stbi_failure_reason();
return reason != nullptr ? reason : "corrupt image";
}
[[noreturn]] static void Fail(const std::string& message) {
#if __cpp_exceptions
throw std::runtime_error(message);
#else
Compression::Fatal(message);
#endif
}
// Converts stb's RGBA8 buffer, classifies its opacity and frees it.