Skip to content

Invalid iterator accessed in GraphicsPipelineManager::bake() #103

@Silverlan

Description

@Silverlan

The problem is located in the following code block (lines 918 to 940 in graphics_pipeline_manager.cpp):

auto base_bake_item_iterator = std::find(bake_items.begin(),
                                         bake_items.end(),
                                         current_pipeline_base_pipeline_id);

if (base_bake_item_iterator != bake_items.end() )
{
    /* Case 1 */
    graphics_pipeline_create_info.basePipelineHandle = VK_NULL_HANDLE;
    graphics_pipeline_create_info.basePipelineIndex  = static_cast<int32_t>(base_bake_item_iterator - bake_items.begin() );
}
else
if (base_bake_item_iterator->pipeline_ptr                 != nullptr            &&
    base_bake_item_iterator->pipeline_ptr->baked_pipeline != VK_NULL_HANDLE)
{
    /* Case 2 */
    graphics_pipeline_create_info.basePipelineHandle = base_bake_item_iterator->pipeline_ptr->baked_pipeline;
    graphics_pipeline_create_info.basePipelineIndex  = UINT32_MAX;
}
else
{
    /* Case 3 */
    anvil_assert_fail();
}

The if-condition checks if the iterator base_bake_item_iterator is valid, which means it's invalid in the else branch. However the else-branch attempts to dereference the invalid iterator, resulting in undefined behavior.
The same problem exists in ComputePipelineManager::bake.

I've had this happen when trying to create a derived pipeline using create_derivative.

Metadata

Metadata

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions