assimp: patch CVE-2026-117608

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-117608

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-oe/recipes-graphics/assimp/assimp/CVE-2026-117608.patch

@@ -0,0 +1,62 @@
+From 9b9c149237ff7bf7f71db8eba7b6cc707e00e0bc Mon Sep 17 00:00:00 2001
+From: venkatchalla06 <111296179+venkatchalla06@users.noreply.github.com>
+Date: Sun, 25 Oct 2026 19:48:47 +0530
+Subject: [PATCH] MD2: compute the frame-table bounds check in 64-bit (integer
+ overflow) (#6963)
+
+The header validation rejects out-of-file offsets with
+    offsetFrames + numFrames * frameSize >= fileSize
+but numFrames is an attacker-controlled uint32 and frameSize is an unsigned
+int that grows with numVertices (another uint32 field), so the product is a
+32-bit multiply that can wrap. The AI_MAX_ALLOC guards above bound numFrames
+only against sizeof(MD2::Frame) (~44 bytes, ceiling ~48M), while frameSize can
+be far larger (e.g. numVertices=1014 -> 4096), so numFrames ~= 2^20 already
+wraps numFrames*frameSize to a small value and the check passes. The frame
+vertices are then read out of bounds (heap OOB read / info leak).
+
+Compute frameSize and the four offset+count*size checks in 64-bit so the
+products cannot wrap. Reachable from Assimp::Importer::ReadFile() on a crafted
+.md2 (MD2 is default-enabled). Confirmed with AddressSanitizer
+(heap-buffer-overflow READ in InternReadFile); valid .md2 files
+(dolphin/horse/flag/faerie) still load unchanged.
+
+Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
+Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
+(cherry picked from commit 7dbc85d9218fae017d4fad70269e7569f7b0c870)
+
+CVE: CVE-2026-117608
+Upstream-Status: Backport [https://github.com/assimp/assimp/commit/7dbc85d9218fae017d4fad70269e7569f7b0c870]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ code/AssetLib/MD2/MD2Loader.cpp | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/code/AssetLib/MD2/MD2Loader.cpp b/code/AssetLib/MD2/MD2Loader.cpp
+index f7101560d..adce318f8 100644
+--- a/code/AssetLib/MD2/MD2Loader.cpp
++++ b/code/AssetLib/MD2/MD2Loader.cpp
+@@ -171,13 +171,17 @@ void MD2Importer::ValidateHeader( )
+     }
+ 
+     // -1 because Frame already contains one
+-    unsigned int frameSize = sizeof (MD2::Frame) + (m_pcHeader->numVertices - 1) * sizeof(MD2::Vertex);
+-
+-    if (m_pcHeader->offsetSkins     + m_pcHeader->numSkins * sizeof (MD2::Skin)         >= fileSize ||
+-        m_pcHeader->offsetTexCoords + m_pcHeader->numTexCoords * sizeof (MD2::TexCoord) >= fileSize ||
+-        m_pcHeader->offsetTriangles + m_pcHeader->numTriangles * sizeof (MD2::Triangle) >= fileSize ||
+-        m_pcHeader->offsetFrames    + m_pcHeader->numFrames * frameSize                 >= fileSize ||
+-        m_pcHeader->offsetEnd           > fileSize)
++    // Compute in 64-bit: numVertices/numFrames are attacker-controlled uint32 header
++    // fields, so numFrames * frameSize (frameSize itself grows with numVertices) overflows
++    // a 32-bit product and can wrap past the file-size check below. The AI_MAX_ALLOC guards
++    // above only bound each count against sizeof(element), not against this product.
++    const uint64_t frameSize = (uint64_t)sizeof(MD2::Frame) + (uint64_t)(m_pcHeader->numVertices - 1) * sizeof(MD2::Vertex);
++
++    if ((uint64_t)m_pcHeader->offsetSkins     + (uint64_t)m_pcHeader->numSkins     * sizeof(MD2::Skin)     >= fileSize ||
++        (uint64_t)m_pcHeader->offsetTexCoords + (uint64_t)m_pcHeader->numTexCoords * sizeof(MD2::TexCoord) >= fileSize ||
++        (uint64_t)m_pcHeader->offsetTriangles + (uint64_t)m_pcHeader->numTriangles * sizeof(MD2::Triangle) >= fileSize ||
++        (uint64_t)m_pcHeader->offsetFrames    + (uint64_t)m_pcHeader->numFrames    * frameSize             >= fileSize ||
++        m_pcHeader->offsetEnd > fileSize)
+     {
+         throw DeadlyImportError("Invalid MD2 header: Some offsets are outside the file");
+     }

meta-oe/recipes-graphics/assimp/assimp_git.bb

@@ -9,7 +9,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=f2d38c9e0d63058b051065fb7b1102a8"
 
 DEPENDS = "zlib"
 
-SRC_URI = "git://github.com/assimp/assimp.git;protocol=https;branch=master"
+SRC_URI = "git://github.com/assimp/assimp.git;protocol=https;branch=master \
+           file://CVE-2026-117608.patch \
+"
 
 SRCREV = "fe1965b3e73f7c241265e8e5b3015764936a6ce5"