Skip to content

fix oob read on empty array initializer in convertInitializerList#4350

Open
saddamr3e wants to merge 1 commit into
KhronosGroup:mainfrom
saddamr3e:initializer-empty-array-oob
Open

fix oob read on empty array initializer in convertInitializerList#4350
saddamr3e wants to merge 1 commit into
KhronosGroup:mainfrom
saddamr3e:initializer-empty-array-oob

Conversation

@saddamr3e

Copy link
Copy Markdown
Contributor

ASan, on a shader with a nested empty initializer list:

SEGV on unknown address 0x000000000000
ParseHelper.cpp:9987 in glslang::TParseContext::convertInitializerList

The array branch reads getSequence()[0] to derive inner array dimensions but never checks the initializer list is non-empty. A nested {} (an empty EOpNull aggregate, legal under GL_EXT_null_initializer) that lands on an array element type reaches it with a zero-length sequence, so the index runs past the end. The struct/matrix/vector branches already validate the count first, and the HLSL convertInitializerList guards the same read with size() > 0. Reject the empty list with an error to match.

Repro: int a[1][3] = { {} }; with GL_EXT_null_initializer. Test added under gtests AST (glsl.nullInitializer.error.vert).

@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@arcady-lunarg

Copy link
Copy Markdown
Contributor

@saddamr3e I think you'll need to re-sign the CLA because they changed to a different CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants