Commit 85e2c34
preprocessor: guard against OOB read in handlePragma for #pragma STDGL
When a shader contains '#pragma STDGL' with fewer than 4 tokens, the
condition at ParseHelper.cpp:422 accessed tokens[1] and tokens[3]
without first checking tokens.size(), causing an out-of-bounds read
and a SEGV under AddressSanitizer.
Every other tokens[N] access in handlePragma() already has an explicit
size check (see lines 340, 366). Apply the same guard here:
} else if (spvVersion.spv > 0 && tokens[0].compare("STDGL") == 0 &&
tokens.size() >= 4 &&
tokens[1].compare("invariant") == 0 &&
tokens[3].compare("all") == 0) {
Minimal reproducer (15 bytes, requires Vulkan/SPIR-V target):
#pragma STDGL
Found by libFuzzer + ASan on fuzz_glslang_direct harness.
Fixes: SEGV in glslang::TParseContext::handlePragma() (ParseHelper.cpp:422)1 parent 8bf4087 commit 85e2c34
4 files changed
Lines changed: 27 additions & 0 deletions
File tree
- Test
- baseResults
- glslang/MachineIndependent
- gtests
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
419 | 419 | | |
420 | 420 | | |
421 | 421 | | |
| 422 | + | |
422 | 423 | | |
423 | 424 | | |
424 | 425 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
315 | 315 | | |
316 | 316 | | |
317 | 317 | | |
| 318 | + | |
318 | 319 | | |
319 | 320 | | |
320 | 321 | | |
| |||
0 commit comments