Skip to content

fix oob read on empty block member list in getBlockSize - #4380

Merged
arcady-lunarg merged 2 commits into
KhronosGroup:mainfrom
saddamr3e:getblocksize-empty-block
Aug 13, 2026
Merged

fix oob read on empty block member list in getBlockSize#4380
arcady-lunarg merged 2 commits into
KhronosGroup:mainfrom
saddamr3e:getblocksize-empty-block

Conversation

@saddamr3e

Copy link
Copy Markdown
Contributor

ASAN, compute shader with a forward-declared GL_EXT_buffer_reference block that never gets a body:

SEGV on unknown address 0xffffffffffffffe0
#0 glslang::TIntermediate::getOffset(TType const&, int) linkValidate.cpp:2736
#1 glslang::TIntermediate::getBlockSize(TType const&) linkValidate.cpp:2757
#2 glslang::TIntermediate::computeBufferReferenceTypeSize(TType const&) linkValidate.cpp:2771
#3 glslang::TIntermediate::addBinaryMath(...) Intermediate.cpp:136

getBlockSize takes lastIndex = memberList.size() - 1 and indexes memberList[lastIndex]. The referent of a forward-declared buffer_reference whose block body never appears keeps an empty member list, so lastIndex is -1 and TVector::operator[] turns that into a huge size_t offset. Pointer math on such a reference (b = b + 1, or b[0]) reaches it. An empty block is 0 bytes, so return 0 before the subtraction.

Test: spv.bufferReferenceForwardDecl.comp.

@arcady-lunarg arcady-lunarg added the kokoro:run Trigger Google bot runs label Aug 13, 2026
@kokoro-team kokoro-team removed the kokoro:run Trigger Google bot runs label Aug 13, 2026
@arcady-lunarg
arcady-lunarg merged commit a11fc70 into KhronosGroup:main Aug 13, 2026
32 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants