SegFault When Parsing Array Subscript of Invalid buffer_reference type.

[kjyager]

Array subscript on buffer references is permitted by GL_EXT_buffer_reference2, however not if the reference type contains an unsized array. The parser checks for and detects this case within TIntermediate::addBinaryMath(), but the caller does not check for nullptr leading to a segfault.

The segfault should be replicable with the following:
glslangValidator --target-env vulkan1.2 segfault.comp

#version 460
// segfault.comp
#extension GL_EXT_buffer_reference2 : require

layout(buffer_reference, std430) buffer DataType{
    float f[]; // Illegal 
};

layout(set = 0, binding = 0) restrict buffer DataTypeRef{
    DataType data;
};

void main(){
    data[0] = 1.0;
}

---

result is set to nullptr by addBinaryMath(..), then dereferenced.
ParseHelper.cpp:TParseContext::handleBracketDereference

result = intermediate.addBinaryMath(EOpAdd, base, index, loc);
result->setType(base->getType());
return result;

Intermediate.cpp:TIntermediate::addBinaryMath

// No addressing math on struct with unsized array.
if ((left->isReference() && left->getType().getReferentType()->containsUnsizedArray()) ||
    (right->isReference() && right->getType().getReferentType()->containsUnsizedArray())) {
    return nullptr;
}

[johnkslang]

Thanks for the detective work.

[kjyager]

Thanks for the detective work.

Thanks for the fix!