Make sure that locations don't roll over in spirv-val (KhronosGroup#6680)

Fixes KhronosGroup#6436

Author: zoddicus

source/val/validate_interfaces.cpp

@@ -411,13 +411,16 @@ spv_result_t GetLocationsForVariable(
     uint32_t num_components = NumConsumedComponents(_, sub_type);
 
     for (uint32_t array_idx = 0; array_idx < array_size; ++array_idx) {
-      uint32_t array_location = location + (num_locations * array_idx);
-      uint32_t start = array_location * 4;
-      if (kMaxLocations <= start) {
+      uint64_t array_location_u64 =
+          static_cast<uint64_t>(location) +
+          (static_cast<uint64_t>(num_locations) * array_idx);
+      if (kMaxLocations <= array_location_u64 * 4) {
         // Too many locations, give up.
         break;
       }
 
+      uint32_t array_location = static_cast<uint32_t>(array_location_u64);
+      uint32_t start = array_location * 4;
       uint32_t end = (array_location + num_locations) * 4;
       if (num_components != 0) {
         start += component;
@@ -487,19 +490,22 @@ spv_result_t GetLocationsForVariable(
         component = member_components[i - 1];
       }
 
-      uint32_t start = location * 4;
-      if (kMaxLocations <= start) {
+      uint64_t start_u64 = static_cast<uint64_t>(location) * 4;
+      if (kMaxLocations <= start_u64) {
         // Too many locations, give up.
         continue;
       }
 
+      uint32_t start = static_cast<uint32_t>(start_u64);
       if (member->opcode() == spv::Op::OpTypeArray && num_components >= 1 &&
           num_components < 4) {
         // When an array has an element that takes less than a location in
         // size, calculate the used locations in a strided manner.
         for (uint32_t l = location; l < num_locations + location; ++l) {
           for (uint32_t c = component; c < component + num_components; ++c) {
-            uint32_t check = 4 * l + c;
+            uint64_t check_u64 = static_cast<uint64_t>(l) * 4 + c;
+            if (kMaxLocations <= check_u64) continue;
+            uint32_t check = static_cast<uint32_t>(check_u64);
             if (!locations->insert(check).second) {
               return _.diag(SPV_ERROR_INVALID_DATA, entry_point)
                      << (is_output ? _.VkErrorID(8722) : _.VkErrorID(8721))

test/val/CMakeLists.txt

@@ -86,6 +86,7 @@ add_spvtools_unittest(TARGET val_fghijklmnop
        val_interfaces_test.cpp
        val_layout_test.cpp
        val_literals_test.cpp
+       val_location_rollover_test.cpp
        val_logical_pointers_test.cpp
        val_logicals_test.cpp
        val_memory_test.cpp

test/val/val_location_rollover_test.cpp

@@ -0,0 +1,116 @@
+// Copyright (c) 2026 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Tests location integer rollover is correctly handles
+
+#include <string>
+
+#include "gmock/gmock.h"
+#include "test/unit_spirv.h"
+#include "test/val/val_fixtures.h"
+
+namespace spvtools {
+namespace val {
+namespace {
+
+using ::testing::HasSubstr;
+
+using ValidateLocationRollover = spvtest::ValidateBase<bool>;
+
+TEST_F(ValidateLocationRollover, VulkanLocationRollover) {
+  std::string text = R"(
+OpCapability Shader
+OpMemoryModel Logical GLSL450
+OpEntryPoint Fragment %1 "func" %var1 %var2
+OpExecutionMode %1 OriginUpperLeft
+OpDecorate %var1 Location 0
+OpDecorate %var2 Location 1073741824
+%2 = OpTypeVoid
+%3 = OpTypeInt 32 0
+%4 = OpTypePointer Output %3
+%var1 = OpVariable %4 Output
+%var2 = OpVariable %4 Output
+%6 = OpTypeFunction %2
+%1 = OpFunction %2 None %6
+%7 = OpLabel
+OpReturn
+OpFunctionEnd
+)";
+
+  // 1073741824 * 4 = 4294967296 (2^32), which overflows to 0 in 32-bit.
+  // This would cause it to be treated as Location 0 and conflict with %var1.
+
+  CompileSuccessfully(text, SPV_ENV_VULKAN_1_2);
+  EXPECT_EQ(SPV_SUCCESS, ValidateInstructions(SPV_ENV_VULKAN_1_2))
+      << getDiagnosticString();
+}
+
+TEST_F(ValidateLocationRollover, VulkanLocationRolloverStructMember) {
+  std::string text = R"(
+OpCapability Shader
+OpMemoryModel Logical GLSL450
+OpEntryPoint Fragment %1 "func" %var
+OpExecutionMode %1 OriginUpperLeft
+OpMemberDecorate %struct 0 Location 0
+OpMemberDecorate %struct 1 Location 1073741824
+OpDecorate %struct Block
+%2 = OpTypeVoid
+%3 = OpTypeInt 32 0
+%struct = OpTypeStruct %3 %3
+%4 = OpTypePointer Output %struct
+%var = OpVariable %4 Output
+%6 = OpTypeFunction %2
+%1 = OpFunction %2 None %6
+%7 = OpLabel
+OpReturn
+OpFunctionEnd
+)";
+
+  CompileSuccessfully(text, SPV_ENV_VULKAN_1_2);
+  EXPECT_EQ(SPV_SUCCESS, ValidateInstructions(SPV_ENV_VULKAN_1_2))
+      << getDiagnosticString();
+}
+
+TEST_F(ValidateLocationRollover, VulkanLocationRolloverStructMemberStrided) {
+  std::string text = R"(
+OpCapability Shader
+OpMemoryModel Logical GLSL450
+OpEntryPoint Fragment %1 "func" %var
+OpExecutionMode %1 OriginUpperLeft
+OpMemberDecorate %struct 0 Location 0
+OpMemberDecorate %struct 1 Location 1073741824
+OpDecorate %struct Block
+%void = OpTypeVoid
+%u32 = OpTypeInt 32 0
+%u32_1 = OpConstant %u32 1
+%u32_2 = OpTypeVector %u32 2
+%array = OpTypeArray %u32_2 %u32_1
+%struct = OpTypeStruct %u32 %array
+%ptr = OpTypePointer Output %struct
+%var = OpVariable %ptr Output
+%func_type = OpTypeFunction %void
+%1 = OpFunction %void None %func_type
+%label = OpLabel
+OpReturn
+OpFunctionEnd
+)";
+
+  CompileSuccessfully(text, SPV_ENV_VULKAN_1_2);
+  EXPECT_EQ(SPV_SUCCESS, ValidateInstructions(SPV_ENV_VULKAN_1_2))
+      << getDiagnosticString();
+}
+
+}  // namespace
+}  // namespace val
+}  // namespace spvtools