Skip to content

index pd_details by matched device in settings device config apply#1930

Merged
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:pd-details-oob-index
Jun 9, 2026
Merged

index pd_details by matched device in settings device config apply#1930
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:pd-details-oob-index

Conversation

@aizu-m

@aizu-m aizu-m commented Jun 9, 2026

Copy link
Copy Markdown
Contributor
pd_details: 1 element (phys_dev_count_term), 552 bytes
i=1  &pd_details[i] lands past the end  ->  out-of-bounds read

pd_details in loader_apply_settings_device_configurations is sized by
inst->phys_dev_count_term, one entry per enumerated VkPhysicalDevice. The inner
loop walks the real devices with j and matches each settings-file
device_configuration (outer index i) against them.

Spotted while reading the device_configurations path. The two debug log lines in
the match block read pd_details[i] for driverName and driverVersion. i is the
outer index over inst->settings.device_configuration_count, which comes from
vk_loader_settings.json, not from the device array. The deviceName beside them
already uses pd_details[j], so j is the index that was meant.

A settings file may list more device_configurations than there are devices.
Duplicate one real device's deviceUUID/driverUUID/driverVersion across several
entries and every entry matches that same device. Once i passes
phys_dev_count_term the read walks off the end of the stack allocation.
driverVersion is read unconditionally as a vararg; the driverName %s read
follows when debug logging is on.

All three reads now use pd_details[j].

@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

1 similar comment
@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

@charles-lunarg charles-lunarg left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Classic mixing up i and j. I took a minute to read the description and wasn't certain just how much code would change to need such a long explanation.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build queued with queue ID 766093.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3541 running.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3541 passed.

@charles-lunarg charles-lunarg merged commit 9f37518 into KhronosGroup:main Jun 9, 2026
46 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants