Fix heap-buffer-overflow and edge cases when parsing GMSH files.

1. Resource buffers are length-delimited, not null-terminated: FileToMemory
   sizes its vector to the file length, and mj_addBufferVFS copies exactly the
   bytes it is given. LoadGMSH handed such a buffer straight to sscanf, whose
   internal scan ran off the end for any GMSH file with no NUL byte after
   "$MeshFormat" -- that is, every ASCII .msh. Parse a bounded copy of the
   version line instead. Under -fsanitize=address this aborted ~15 UserFlexTest
   MSH cases, RecompileCompareTest and WriteReadCompareTest.
2. The "missing $Nodes" and "missing $Elements" checks tested nodebegin/elembegin
   for -1 after the section name length had already been added to them, so they
   were never true. Check for sections before offsetting past their names.
3. findstring stopped scanning at buffer_sz - len, one position short of the
   last possible match, so a marker flush against the end of the buffer was
   reported as absent. Scan up to buffer_sz - len.
4. Add regression tests for truncated headers, missing sections, and EOF markers.

PiperOrigin-RevId: 985075471
Change-Id: Ib62509d1d509d54014b49ce898345c43fe7ab6e7

Author: yuvaltassa

doc/changelog.rst

@@ -57,6 +57,8 @@ Bug fixes
   register the forces that tendons apply to bodies (:issue:`832`).
 - :ref:`mjd_transitionFD` and :ref:`mjd_inverseFD` now raise an error when :ref:`sleeping<Sleeping>` is enabled.
   Previously, their repeated evaluations changed the sleep state, leading to internal errors or wrong derivatives.
+- Fixed an out-of-bounds read when parsing the header of a :ref:`GMSH file<gmsh-file-docs>` loaded by
+  :ref:`flexcomp<body-flexcomp>`. Truncated headers are now reported as an error.
 
 Version 3.13.0 (September 8, 2026)
 ----------------------------------

src/user/user_flexcomp.cc

@@ -1367,8 +1367,8 @@ bool mjCFlexcomp::MakeMesh(
 static int findstring(const char* buffer, int buffer_sz, const char* str) {
   int len = (int)strlen(str);
 
-  // scan buffer
-  for (int i = 0; i < buffer_sz - len; i++) {
+  // scan buffer, including a match ending at the last byte
+  for (int i = 0; i <= buffer_sz - len; i++) {
     // check for string at position i
     bool found = true;
     for (int k = 0; k < len; k++) {
@@ -1965,12 +1965,13 @@ void mjCFlexcomp::LoadGMSH(mjCModel* model, mjResource* resource) {
     throw mjCError(NULL, "GMSH file must begin with $MeshFormat");
   }
 
-  // check version, determine ascii or binary
-  double version;
-  int    binary;
-  if (sscanf(buffer + 11, "%lf %d", &version, &binary) != 2) {
-    throw mjCError(NULL, "Could not read GMSH file header");
-  }
+  // check version, determine ascii or binary; the resource buffer is not
+  // null-terminated, so parse a bounded copy of the version line
+  constexpr int kGmshVersionLineMax = 64;
+  stringstream  header(std::string(buffer + 11, std::min(buffer_sz - 11, kGmshVersionLineMax)));
+  double        version;
+  int           binary;
+  if (!(header >> version >> binary)) { throw mjCError(NULL, "Could not read GMSH file header"); }
   if (mju_round(100 * version) != 220 && mju_round(100 * version) != 410) {
     throw mjCError(NULL, "Only GMSH file format versions 4.1 and 2.2 are supported");
   }
@@ -1982,14 +1983,16 @@ void mjCFlexcomp::LoadGMSH(mjCModel* model, mjResource* resource) {
   int elemend   = findstring(buffer, buffer_sz, "$EndElements");
 
 
+  // check sections are present, before begin is offset past the section name
+  if (nodebegin < 0) { throw mjCError(NULL, "GMSH file missing $Nodes"); }
+  if (elembegin < 0) { throw mjCError(NULL, "GMSH file missing $Elements"); }
+
   // correct begin for string size, +1 for LF in binary (CRLF in Win ascii works)
   nodebegin += (int)strlen("$Nodes") + 1;
   elembegin += (int)strlen("$Elements") + 1;
 
-  // check sections
-  if (nodebegin < 0) { throw mjCError(NULL, "GMSH file missing $Nodes"); }
+  // check sections are closed
   if (nodeend < nodebegin) { throw mjCError(NULL, "GMSH file missing $EndNodes after $Nodes"); }
-  if (elembegin < 0) { throw mjCError(NULL, "GMSH file missing $Elements"); }
   if (elemend < elembegin) {
     throw mjCError(NULL, "GMSH file missing $EndElements after $Elements");
   }

test/user/user_flex_test.cc

@@ -15,6 +15,7 @@
 // Tests for user/user_model.cc.
 
 #include <array>
+#include <cstdio>
 #include <memory>
 #include <string>
 
@@ -826,6 +827,121 @@ TEST_F(UserFlexTest, LoadMSHASCII_22_MissingElement_Fail) {
   mj_deleteModel(m);
 }
 
+// Resource buffers are not null-terminated, so the GMSH header parser must stay
+// within the reported size. A file that is exactly "$MeshFormat" leaves nothing
+// after the tag; reading on is a heap overflow.
+TEST_F(UserFlexTest, LoadMSHTruncatedHeader_Fail) {
+  static constexpr char msh[] = "$MeshFormat";
+
+  // sizeof - 1: the buffer must be added without its terminating null
+  mjVFS vfs;
+  mj_defaultVFS(&vfs);
+  mj_addBufferVFS(&vfs, "truncated.msh", msh, sizeof(msh) - 1);
+
+  static constexpr char xml[] = R"(
+  <mujoco>
+    <worldbody>
+      <flexcomp name="test" type="gmsh" dim="3" radius=".001"
+                file="truncated.msh"/>
+    </worldbody>
+  </mujoco>
+  )";
+  std::array<char, 1024> error;
+  MjModelPtr m = LoadModelFromString(xml, error.data(), error.size(), &vfs);
+  EXPECT_THAT(m.get(), IsNull());
+  EXPECT_THAT(error.data(), HasSubstr("Could not read GMSH file header"));
+  mj_deleteVFS(&vfs);
+}
+
+TEST_F(UserFlexTest, LoadMSHMissingNodesSection_Fail) {
+  static constexpr char msh[] =
+      "$MeshFormat\n4.1 0 8\n$EndMeshFormat\n"
+      "$Elements\n1 1 1 1\n3 1 4 1\n1 1 1 1 1\n$EndElements\n";
+
+  mjVFS vfs;
+  mj_defaultVFS(&vfs);
+  mj_addBufferVFS(&vfs, "nonodes.msh", msh, sizeof(msh) - 1);
+
+  static constexpr char xml[] = R"(
+  <mujoco>
+    <worldbody>
+      <flexcomp name="test" type="gmsh" dim="3" radius=".001"
+                file="nonodes.msh"/>
+    </worldbody>
+  </mujoco>
+  )";
+  std::array<char, 1024> error;
+  MjModelPtr m = LoadModelFromString(xml, error.data(), error.size(), &vfs);
+  EXPECT_THAT(m.get(), IsNull());
+  EXPECT_THAT(error.data(), HasSubstr("GMSH file missing $Nodes"));
+  mj_deleteVFS(&vfs);
+}
+
+TEST_F(UserFlexTest, LoadMSHMissingElementsSection_Fail) {
+  static constexpr char msh[] =
+      "$MeshFormat\n4.1 0 8\n$EndMeshFormat\n"
+      "$Nodes\n1 1 1 1\n3 1 0 1\n1\n0 0 0\n$EndNodes\n";
+
+  mjVFS vfs;
+  mj_defaultVFS(&vfs);
+  mj_addBufferVFS(&vfs, "noelements.msh", msh, sizeof(msh) - 1);
+
+  static constexpr char xml[] = R"(
+  <mujoco>
+    <worldbody>
+      <flexcomp name="test" type="gmsh" dim="3" radius=".001"
+                file="noelements.msh"/>
+    </worldbody>
+  </mujoco>
+  )";
+  std::array<char, 1024> error;
+  MjModelPtr m = LoadModelFromString(xml, error.data(), error.size(), &vfs);
+  EXPECT_THAT(m.get(), IsNull());
+  EXPECT_THAT(error.data(), HasSubstr("GMSH file missing $Elements"));
+  mj_deleteVFS(&vfs);
+}
+
+// The last section marker of a GMSH file need not be followed by a newline.
+TEST_F(UserFlexTest, LoadMSHEndMarkerAtEOF_Success) {
+  // read a well-formed GMSH file
+  const std::string msh_path =
+      GetTestDataFilePath("user/testdata/cube_41_ascii_vol_gmshApp.msh");
+  FILE* f = fopen(msh_path.c_str(), "rb");
+  ASSERT_THAT(f, NotNull()) << "Could not open " << msh_path;
+  fseek(f, 0, SEEK_END);
+  long msh_size = ftell(f);
+  fseek(f, 0, SEEK_SET);
+  std::string msh(msh_size, '\0');
+  fread(msh.data(), 1, msh_size, f);
+  fclose(f);
+
+  // drop the newline after the final $EndElements
+  static constexpr char kEndElements[] = "$EndElements";
+  size_t end = msh.rfind(kEndElements);
+  ASSERT_NE(end, std::string::npos);
+  msh.resize(end + sizeof(kEndElements) - 1);
+
+  mjVFS vfs;
+  mj_defaultVFS(&vfs);
+  mj_addBufferVFS(&vfs, "cube.msh", msh.data(), msh.size());
+
+  static constexpr char xml[] = R"(
+  <mujoco>
+    <worldbody>
+      <flexcomp name="test" type="gmsh" dim="3" radius=".001" file="cube.msh">
+        <edge equality="true"/>
+      </flexcomp>
+    </worldbody>
+  </mujoco>
+  )";
+  std::array<char, 1024> error;
+  MjModelPtr m = LoadModelFromString(xml, error.data(), error.size(), &vfs);
+  ASSERT_THAT(m.get(), NotNull()) << error.data();
+  EXPECT_EQ(m->nflexvert, 14);
+  EXPECT_EQ(m->nflexelem, 24);
+  mj_deleteVFS(&vfs);
+}
+
 TEST_F(UserFlexTest, LoadMSHASCII_dim_missing_in_xml) {
   const std::string xml_path = GetTestDataFilePath(
       "user/testdata/cube_22_ascii_vol_gmshApp_missing_dim.xml");