Review of #2158: a buffer-backed accessor is checked against its buffer, but
each primitive that references it reads it again and keeps its own copy, so a
3 MB file listing 50,000 references to one 100,000-vertex accessor asked for
about 80 GB. Every accessor read, with or without a bufferView, is now
charged to one budget for the whole file, as is what a primitive keeps
besides its reads: generated indices when `indices` is missing, the triangle
list (3(k-2) for a strip or fan of k), flat-normal vertices and computed
tangents. Going over it is the usual malformed-file error.
The cap is a fixed 2^28 components (about 1 GiB as f32/u32), not a multiple
of the buffer size: real assets share one vertex buffer across many
primitives, and a 10M-triangle scan reads about 90M components. Buffer-less
accessors keep their tighter 16M sub-budget.
Found while testing crates/model/src/gltf.rs:83-96 (uri_decode)
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The per-accessor count checks from #1235 already reject the audit's trigger
(a MAT4 accessor with count 10^11); a regression test now pins it. What was
left: accessors without a bufferView were capped at 16M components each, but
nothing backs them, so one capped accessor referenced from many primitives
allocated 64 MB per reference. The cap is now one budget for the whole file.
Per-element offsets use checked arithmetic as well.
Accessor counts sized the f32/u32 output before the buffer view was looked
at, and offsets, strides and count * components used unchecked arithmetic,
so a few hundred bytes of JSON could request a multi-gigabyte allocation
(aborting the process) or overflow.
- Doc::layout checks count * components, adds the view and accessor offsets,
rejects a byteStride smaller than an element, and checks that the last
element ends inside the buffer, all with checked arithmetic, before
floats() or ints() allocate anything.
- Accessors without a buffer view (all zeros) are capped at 2^24 components.
- idx() and node index lists use usize::try_from instead of 'as usize'; an
image bufferView's end and a GLB chunk's end are computed with checked_add.
Fixes#1235
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9kwMcw2pYQ5fSjKa3ZPnh
Layer > Camera > Create Stereo 3D Rig (left/right eye comps with expression-linked eye
cameras, Stereo 3D Controls effect, stereo comp through 3D Glasses), Create Orbit Null,
Create Cameras from 3D Model; Layer > Light > Create Lights from 3D Model
(KHR_lights_punctual), Control Light with Camera, Create Environment Light Background
Layer (equirectangular sky drawn through the camera). glTF cameras and punctual lights
are parsed by effectcraft-model.
Advanced 3D: per-sample motion blur over the comp shutter, and blend modes / track
mattes / Preserve Transparency composited through the 2D path in depth order.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New crate effectcraft-model (L2): glTF 2.0 (.gltf/.glb, data URIs, external buffers and
images, PBR metallic-roughness with base/MR/normal/occlusion/emissive textures, node
hierarchy, skins, step/linear/cubic animations) and OBJ/MTL import, parametric primitives,
extruded/bevelled outline meshes and polygon triangulation with holes.
Project: FootageKind::Model, LayerSource::Model/Primitive, Layer::environment, Geometry and
Material Options builders, Environment light Source. Media probes and loads models
(FootageSource::model). Engine: layer.newModel, layer.new3dPrimitive/newPrimitive,
comp.renderer, layer.environment, material.set/reset/duplicateAssign/revealSource (stubs
replaced); File > Import and layer.addItem pick up models. Hand-written fixtures with
attribution sidecars.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
BFlat