yum-mirror/glslang

git clone https://git.yummers.dev/yum-mirror/glslang

Ashish Dhonepreprocessor: guard elseSeen/ifdepth against negative elsetracker2eb8a581

main
branchesmainall refs →
1.2 KiB42 linesraw
1// Test: guard against elseSeen[elsetracker] OOB write when elsetracker < 0.
2//
3// A malformed #if expression causes eval() to return err=true; CPPif increments
4// ifdepth/elsetracker but skips the branch scan.  The subsequent nested
5// #if 0 / #endif block enters CPPelse with depth > 0, driving ifdepth negative
6// via the unguarded --ifdepth at Pp.cpp:328.  Once ifdepth < 0 the
7// readCPPline guard (if (ifdepth == 0)) is permanently bypassed, and every
8// further #endif decrements elsetracker without bound.
9//
10// Without the fix, elseSeen[elsetracker] writes 0x00 backward through TPpContext
11// into lastLineTokenLocs, crashing in scanToken (PpContext.h:384).
12// With the fix, both write sites check elsetracker >= 0, and the unguarded
13// --ifdepth is protected by if (ifdepth > 0).
14
15#version 450
16
17// Step 1: bad expression desynchronises ifdepth and elsetracker.
18#if %%%
19#endif
20
21// Step 2: nested block enters CPPelse depth>0 path, ifdepth goes negative.
22#if 0
23  #if 1
24    #if 1
25    #endif
26  #endif
27#endif
28
29// Step 3: excess #endifs hit readCPPline with ifdepth < 0; without the
30// elsetracker >= 0 guard they would write OOB into the struct.
31#endif
32#endif
33#endif
34#endif
35#endif
36#endif
37#endif
38#endif
39#endif
40#endif
41
42void main() {}