Skip to content

fix out-of-bounds read on empty block in layoutObjectCheck#4306

Merged
arcady-lunarg merged 1 commit into
KhronosGroup:mainfrom
saddamr3e:layout-object-empty-block
Jul 2, 2026
Merged

fix out-of-bounds read on empty block in layoutObjectCheck#4306
arcady-lunarg merged 1 commit into
KhronosGroup:mainfrom
saddamr3e:layout-object-empty-block

Conversation

@saddamr3e

Copy link
Copy Markdown
Contributor

ASan, Vulkan/SPIR-V target, tessellation-control stage:

ParseHelper.cpp:7770: container-overflow ... layoutObjectCheck
READ of size 8 ... (*type.getStruct())[0]

Redeclaring a built-in block with an instance name and members that don't match
the originals erases every original member (the instance-name erase in
redeclareBuiltinBlock), so the block is left with an empty member list.
layoutObjectCheck then reads member [0] to inspect its location qualifier, past
the end of an empty list. Skip the member check when the block has no members.

Repro:

#version 450
in gl_PerVertex {
    float bad;
} gl_in[];
void main() {}

compiled for a tesc stage with a Vulkan target.

@saddamr3e

Copy link
Copy Markdown
Contributor Author

gentle ping

@arcady-lunarg arcady-lunarg added the kokoro:run Trigger Google bot runs label Jul 2, 2026
@kokoro-team kokoro-team removed the kokoro:run Trigger Google bot runs label Jul 2, 2026
@arcady-lunarg arcady-lunarg merged commit 6d50815 into KhronosGroup:main Jul 2, 2026
34 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants