fix spirv compile failure diagnostics read past shader buffer - #6882
Open
lazypool wants to merge 1 commit into
Open
fix spirv compile failure diagnostics read past shader buffer#6882lazypool wants to merge 1 commit into
lazypool wants to merge 1 commit into
Conversation
…t#6881) the shader source slice passed to glslang (comp_datas[3]) is not null-terminated, since the .comp_data arrays generated by ncnn_generate_shader_comp_header.cmake are hex-encoded without a trailing 0x00. the error-printing path in compile_spirv_module() scanned it with strchr() and checked *p != '\0', causing an out-of-bounds read and garbled diagnostics whenever a shader fails to compile. bound the scan with memchr() using the known source length and print the trailing partial line with %.*s instead of relying on null-termination. verified with asan: before, a broken non-null- terminated shader source reports a stack-buffer-overflow in compile_spirv_module(); after, the error path prints correctly with no overrun. Signed-off-by: lazypool <lazypool@proton.me> Co-authored-by: Marcin Sochacki <136440930+marcin-sochacki@users.noreply.github.com>
Member
|
|
lazypool
commented
Aug 1, 2026
lazypool
left a comment
Author
There was a problem hiding this comment.
Please review when you get a chance, thanks!
marcin-sochacki
added a commit
to marcin-sochacki/aports
that referenced
this pull request
Aug 3, 2026
arbassett
pushed a commit
to qnx-ports/aports
that referenced
this pull request
Aug 20, 2026
* extra/ncnn: add port * backport of upstream Tencent/ncnn#6882 * add python bindings + fix python related ncnn issues * let abuild handle parallelization
|
Please enable github action in YOUR FORKED REPO to make code-format workflow work |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #6881 — the error-printing path in
compile_spirv_module()(src/gpu.cpp) treated the shader source slice as a null-terminated C string when it is not, causing an out-of-bounds read and garbled diagnostic output whenever a Vulkan compute shader fails to compile.Root cause
.comp_data[]arrays are generated bycmake/ncnn_generate_shader_comp_header.cmakeas hex-encoded bytes without a trailing0x00.compile_spirv_module()slices the source intocomp_datas[3](everything after#version) and, on parse failure, scans it withstrchr()/*p != '\0'— both require null-termination, but none is guaranteed.strchr()walks past the end of the buffer into adjacent memory, printing garbage (or, with ASan, reporting astack-buffer-overflow).Change
Bound the scan using the already-known source length (
comp_data_size_2, the size ofcomp_datas[3]):strchr(p, '\n')→memchr(p, '\n', p_end - p)if (*p != '\0')→if (p != p_end)%sprint →%.*swith the remaining lengthVerification
Built with
-DNCNN_VULKAN=ON(system glslang 16.3.0) and tested under AddressSanitizer on RADV:compile_spirv_module(data, size, ...)→ERROR: AddressSanitizer: stack-buffer-overflow ... in ncnn::compile_spirv_module(...)1:\tvoid main() { ... }), no ASan report; a real shader still compiles (rc=0).No behavioral change to successful compilation paths.