Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Fixed all OOB accesses in VertexProgram and PixelProgram #18567

Merged
merged 1 commit into from Jun 7, 2019

Conversation

miniak
Copy link
Contributor

@miniak miniak commented Jun 1, 2019

Description of Change

Backport fixes for:

https://swiftshader.googlesource.com/SwiftShader.git/+/0e6a044dff9facf499739be93536bd7f7cc4c6bf

Fix undefined behavior in OFFSET().

Accessing members of a null pointer is undefined behavior, even when
only used to obtain the address again. So use a non-zero value as the
base pointer address instead. 32 was chosen to provide sufficient
alignment guarantees.

https://swiftshader.googlesource.com/SwiftShader.git/+/48d47a4912684bfa4d23d3cdaab60046bf3d0468

Fixed all OOB accesses in VertexProgram and PixelProgram

A lot of arrays in VertexProgram and PixelProgram have fixed sizes,
so programs that have more nested loops or ifs or deeper call stacks
can cause OOB accesses, which causes security issues in Chromium.

Index clamping was added to prevent any OOB memory accesses here.

This could eventually be fixed properly by first verifying these sizes
and giving shader compile errors when these limits are exceeded.

/cc @electron/wg-security

Checklist

Release Notes

Notes: Backported fix for: https://bugs.chromium.org/p/chromium/issues/detail?id=915197, https://bugs.chromium.org/p/chromium/issues/detail?id=915206 and https://bugs.chromium.org/p/chromium/issues/detail?id=915218.

@miniak miniak added the 4-2-x label Jun 1, 2019
@miniak miniak requested a review from a team June 1, 2019 22:16
@miniak miniak self-assigned this Jun 1, 2019
@electron-cation electron-cation bot added the new-pr 🌱 PR opened in the last 24 hours label Jun 1, 2019
@miniak miniak force-pushed the miniak/backport-swiftshader-4-2-x branch from 80df447 to 9c684d0 Compare June 1, 2019 22:26
@electron-cation electron-cation bot removed the new-pr 🌱 PR opened in the last 24 hours label Jun 2, 2019
@miniak miniak added security 🔒 backport This is a backport PR labels Jun 3, 2019
Copy link
Member

@deepak1556 deepak1556 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Marking it for fixing the compilation errors.

@miniak miniak force-pushed the miniak/backport-swiftshader-4-2-x branch from 9c684d0 to 25aae40 Compare June 5, 2019 09:56
@miniak miniak force-pushed the miniak/backport-swiftshader-4-2-x branch from 25aae40 to 5001b8d Compare June 5, 2019 11:07
@miniak miniak requested review from deepak1556 and zcbenz and removed request for deepak1556 June 6, 2019 07:41
@miniak
Copy link
Contributor Author

miniak commented Jun 6, 2019

@deepak1556 I've fixed the build error

@zcbenz zcbenz merged commit 87c0b54 into 4-2-x Jun 7, 2019
@zcbenz zcbenz deleted the miniak/backport-swiftshader-4-2-x branch June 7, 2019 02:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants