mewin/glslang
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix OOB write in matrix constructor

Browse Source 
In a matrix constructor that takes a number of components, as many
components as necessary must be taken, with the rest discarded, as GLSL
allows more components than necessary to be specified.  For example, the
following:

    mat4 m4 = mat4(v4, v4.yzwx, v4.zwx, v4.zwxy, v4.wxyz);

is equivalent to:

    mat4 m4 = mat4(v4, v4.yzwx, v4.zwx, v4.zwxy, v4.w);

glslang takes the components from the constructor and builds the single
components of the matrix in a 2D array before constructing the matrix
itself.  It however did not check for extra parameters and was thus
writing OOB to said 2D array.  This is fixed in this change

Signed-off-by: Shahbaz Youssefi <shabbyx@gmail.com>
This commit is contained in:
Shahbaz Youssefi
2021-06-03 13:42:57 -04:00
parent 6bdcb4be34
commit cfdeeb842d
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
SPIRV/SpvBuilder.cpp
View File

@@ -2543,7 +2543,7 @@ Id Builder::createMatrixConstructor(Decoration precision, const std::vector<Id>&
int row = 0;
int col = 0;
for (int arg = 0; arg < (int)sources.size(); ++arg) {
for (int arg = 0; arg < (int)sources.size() && col < numCols; ++arg) {
Id argComp = sources[arg];
for (int comp = 0; comp < getNumComponents(sources[arg]); ++comp) {
if (getNumComponents(sources[arg]) > 1) {
@@ -2555,6 +2555,10 @@ Id Builder::createMatrixConstructor(Decoration precision, const std::vector<Id>&
row = 0;
col++;
}
if (col == numCols) {
// If more components are provided than fit the matrix, discard the rest.
break;
}
}
}
}