Fix PNTS section bounds validation

CHANGES.md

@@ -11,6 +11,7 @@
 
 ##### Fixes :wrench:
 
+- Fixed PNTS conversion to reject section lengths that exceed the declared tile byte length.
 - `CesiumVectorOverlays::GeoJsonDocumentRasterOverlay` now actually rasterizes `Point` and `MultiPoint` geometry. Previously these were silently dropped before reaching the rasterizer, even though point rendering was already supported.
 - The offsets to string feature data in `MAXAR_content_geojson` tiles are now optimized to an appropriate integer type, instead of always using UINT64.
 

Cesium3DTilesContent/src/PntsToGltfConverter.cpp

@@ -111,6 +111,19 @@ void parsePntsHeader(
         "size specified in its header.");
     return;
   }
+
+  uint64_t sectionsEnd =
+      static_cast<uint64_t>(headerLength) +
+      static_cast<uint64_t>(pHeader->featureTableJsonByteLength) +
+      static_cast<uint64_t>(pHeader->featureTableBinaryByteLength) +
+      static_cast<uint64_t>(pHeader->batchTableJsonByteLength) +
+      static_cast<uint64_t>(pHeader->batchTableBinaryByteLength);
+  if (sectionsEnd > pHeader->byteLength) {
+    result.errors.emplaceError(
+        "The PNTS is invalid because the sum of the header and section lengths "
+        "exceeds the size specified in its header.");
+    return;
+  }
 }
 
 struct PntsSemantic {

Cesium3DTilesContent/test/TestPntsToGltfConverter.cpp

@@ -1312,3 +1312,25 @@ TEST_CASE("Converts batched point cloud with Draco compression to glTF") {
     checkBufferContents<uint8_t>(buffer.cesium.data, expected);
   }
 }
+
+TEST_CASE("Rejects PNTS sections that extend past the declared byte length") {
+  std::filesystem::path testFilePath = Cesium3DTilesSelection_TEST_DATA_DIR;
+  testFilePath = testFilePath / "PointCloud";
+
+  SUBCASE("feature table") {
+    testFilePath = testFilePath / "invalidFeatureTableSectionLength.pnts";
+  }
+
+  SUBCASE("batch table") {
+    testFilePath = testFilePath / "invalidBatchTableSectionLength.pnts";
+  }
+
+  GltfConverterResult result = ConvertTileToGltf::fromPnts(testFilePath);
+
+  CHECK_FALSE(result.model);
+  REQUIRE(result.errors.hasErrors());
+  CHECK(
+      result.errors.errors[0] ==
+      "The PNTS is invalid because the sum of the header and section lengths "
+      "exceeds the size specified in its header.");
+}