Skip to content

fix oob read folding mixed long vector and vector operands - #4491

Open
saddamr3e wants to merge 1 commit into
KhronosGroup:mainfrom
saddamr3e:long-vector-mixed-shape
Open

saddamr3e wants to merge 1 commit into
KhronosGroup:mainfrom
saddamr3e:long-vector-mixed-shape

Conversation

@saddamr3e

Copy link
Copy Markdown
Contributor
  1. TIntermediate::promoteBinary classifies operands with isVector()/isMatrix(), and a GL_EXT_long_vector type is neither, so vector<float, 8> + vec4, mat4 * vector<float, 8> and vector<float, 4> * vec4 are accepted as scalar operations.
  2. TIntermConstantUnion::fold then iterates over the left operand's component count and indexes the shorter right operand's TConstUnionArray past its end: UBSan reports an invalid TBasicType load at ConstantUnion.h:441, debug asserts, release folds the stray bytes into the emitted constant. The non-constant forms hit the isScalar assert in createBinaryOperation or emit an OpFAdd that spirv-val rejects.
    Rejected a long vector mixed with a vector or matrix unless the existing same-size vectorAndLongVectorMatch rule applies, and made that matching pair a component-wise product instead of VectorTimesScalar. Added spv.longVectorBadParams.mixedShape.comp for the rejected forms and extended spv.longVectorLiteral234.comp with the same-size multiply; both crash the unpatched debug build, and ctest is green in Debug+ASan/UBSan and Release.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant