Skip to content

Commit bf84fe4

Browse files
saddamr3earcady-lunarg
authored andcommitted
fix oob read on empty array initializer in convertInitializerList
1 parent 38360f8 commit bf84fe4

4 files changed

Lines changed: 47 additions & 0 deletions

File tree

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
glsl.nullInitializer.error.vert
2+
ERROR: 0:11: 'initializer list' : array initializer must be non-empty
3+
ERROR: 1 compilation errors. No code generated.
4+
5+
6+
Shader version: 460
7+
Requested GL_EXT_null_initializer
8+
ERROR: node is still EOpNull!
9+
0:9 Function Definition: main( ( global void)
10+
0:9 Function Parameters:
11+
0:? Linker Objects
12+
0:? 'gl_VertexID' ( gl_VertexId int VertexId)
13+
0:? 'gl_InstanceID' ( gl_InstanceId int InstanceId)
14+
15+
16+
Linked vertex stage:
17+
18+
19+
Shader version: 460
20+
Requested GL_EXT_null_initializer
21+
ERROR: node is still EOpNull!
22+
0:9 Function Definition: main( ( global void)
23+
0:9 Function Parameters:
24+
0:? Linker Objects
25+
0:? 'gl_VertexID' ( gl_VertexId int VertexId)
26+
0:? 'gl_InstanceID' ( gl_InstanceId int InstanceId)
27+
Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#version 460
2+
#extension GL_EXT_null_initializer : enable
3+
4+
// An empty initializer list ({}) is only valid as a whole null initializer.
5+
// When one appears nested as an array element initializer there are no elements
6+
// to size the array or derive its element type from, so it must be rejected
7+
// rather than reading past the empty initializer sequence.
8+
9+
void main()
10+
{
11+
int a[1][3] = { {} }; // ERROR, empty initializer list for an array element
12+
}

glslang/MachineIndependent/ParseHelper.cpp

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10042,6 +10042,13 @@ TIntermTyped* TParseContext::convertInitializerList(const TSourceLoc& loc, const
1004210042
arrayType.shallowCopy(type); // sharing struct stuff is fine
1004310043
arrayType.copyArraySizes(*type.getArraySizes()); // but get a fresh copy of the array information, to edit below
1004410044

10045+
// a nested empty initializer list ({}) has no elements to size the array or
10046+
// derive its element type from, so reject it before the getSequence()[0] read below
10047+
if (initList->getSequence().empty()) {
10048+
error(loc, "array initializer must be non-empty", "initializer list", "");
10049+
return nullptr;
10050+
}
10051+
1004510052
// edit array sizes to fill in unsized dimensions
1004610053
arrayType.changeOuterArraySize((int)initList->getSequence().size());
1004710054
TIntermTyped* firstInit = initList->getSequence()[0]->getAsTyped();

gtests/AST.FromFile.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,7 @@ INSTANTIATE_TEST_SUITE_P(
313313
"coord_conventions.frag",
314314
"gl_FragCoord.frag",
315315
"glsl.interpOp.error.frag",
316+
"glsl.nullInitializer.error.vert",
316317
"location_aliasing.tesc",
317318
"location_aliasing1.frag",
318319
"GL_EXT_draw_instanced.vert",

0 commit comments

Comments
 (0)