Fixes for issues pointed out by automated fuzzing - #620
Draft
stefanatwork wants to merge 31 commits into
Draft
Conversation
Clamp BVHBuilderMorton settings to MAX_BRANCHING_FACTOR when an oversized maxBranchingFactor is provided via RTCBuildArguments.\n\nAdd an integration test that exercises rtcBuildBVH with RTC_BUILD_QUALITY_LOW and maxBranchingFactor=64 to verify the Morton build path returns a valid root. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* User facing API will return an error * Internal API will thrown an exception
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…hout rejecting valid meshes
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens Embree against a set of fuzzing-discovered edge cases (bounds/time-range handling, builder argument validation, and defensive guards in geometry traversal), and introduces a dedicated regression-test tutorial executable to prevent regressions.
Changes:
- Add
embree_regression_teststutorial executable with targeted API/geometry regression cases. - Add multiple defensive checks across motion-blur bounds, grid leaf decoding, subdivision topology validation, curve index validation, and builder argument validation.
- Minor formatting/whitespace cleanups in a few CMake/test files and headers.
Reviewed changes
Copilot reviewed 23 out of 24 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tutorials/embree_regression_tests/embree_regression_tests.cpp | New regression-test binary covering fuzzing-found edge cases. |
| tutorials/embree_regression_tests/CMakeLists.txt | Builds/installs the new regression-test executable and registers it as a test. |
| tutorials/CMakeLists.txt | Wires the new embree_regression_tests subdirectory into the tutorials build. |
| tests/integration/test_embree_release/test.cpp | Removes trailing whitespace line. |
| tests/CMakeLists.txt | Removes trailing whitespace line. |
| kernels/geometry/grid_soa.h | Adds validation to guard against invalid leaf decoding. |
| kernels/geometry/grid_soa_intersector1.h | Skips intersection/occlusion for invalid encoded grid leaves. |
| kernels/geometry/grid_soa_intersector_packet.h | Same invalid-leaf guards for packet intersectors. |
| kernels/common/scene_subdiv_mesh.cpp | Validates subdiv topology before half-edge initialization to prevent OOB. |
| kernels/common/scene_line_segments.h | Fixes ddPdudu output writing to the wrong pointer. |
| kernels/common/scene_instance.cpp | Adds guards for invalid time ranges/segments in bounds computations. |
| kernels/common/scene_instance_array.h | Replaces asserts with defensive checks for object-id lookup. |
| kernels/common/scene_instance_array.cpp | Adds bounds/object-id validation and range guards in instance-array code paths. |
| kernels/common/scene_curves.h | Hardens curve index validation against overflow/underflow. |
| kernels/common/rtcore_builder.cpp | Validates builder args (leaf size and branching factor per quality). |
| kernels/common/motion_derivative.h | Adds recursion depth and max-root guards to avoid runaway recursion. |
| kernels/common/default.h | Clamps/validates time segment range computation for invalid inputs. |
| kernels/common/accelset.h | Validates time segment ranges before checking per-segment bounds. |
| kernels/builders/bvh_builder_msmblur.h | Validates motion-blur primitive range before using it. |
| kernels/builders/bvh_builder_msmblur_hair.h | Adds branching-factor upper-bound guard. |
| kernels/builders/bvh_builder_morton.h | Adds branching-factor upper-bound guards in settings/builders. |
| kernels/builders/bvh_builder_hair.h | Adds branching-factor upper-bound guard. |
| include/embree4/rtcore_common.h | Whitespace/formatting-only adjustments. |
| common/math/lbbox.h | Adds NaN/range validation and clamping to avoid invalid time-range bounds computation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+203
to
+206
| if (this->numPrimitives == 1) { | ||
| object = objects[0]; | ||
| if (object) { object->refInc(); } | ||
| } |
Comment on lines
+241
to
+243
| RTCScene child = createTriangleScene(device); | ||
| RTCScene top = rtcNewScene(device); | ||
| RTCGeometry inst = rtcNewGeometry(device, RTC_GEOMETRY_TYPE_INSTANCE); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft PR for easier review.