Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Prevent glDeleteQueries from deleting a live Query #18566

Merged
merged 1 commit into from Jun 4, 2019

Conversation

Projects
None yet
3 participants
@miniak
Copy link
Contributor

commented Jun 1, 2019

Description of Change

Backport fix for https://bugs.chromium.org/p/chromium/issues/detail?id=904714
https://swiftshader.googlesource.com/SwiftShader.git/+/3fc6893c8b24c0490ce90dc427b781732a98ff38

Prevent glDeleteQueries from deleting a live Query

glDeleteQueries() instantly deletes all the es2::Query objects
passed as arguments to this function. If some of these queries
are still being used by the renderer, this will result in a use
after free error. To solve this issue, sw::Query is now a also
ref counted object.

/cc @electron/wg-security

Checklist

Release Notes

Notes: Backported fix for https://bugs.chromium.org/p/chromium/issues/detail?id=904714.

@miniak miniak added the 4-2-x label Jun 1, 2019

@miniak miniak requested a review from electron/wg-security Jun 1, 2019

@miniak miniak self-assigned this Jun 1, 2019

@miniak miniak changed the title fix: Prevent glDeleteQueries from deleting a live Query fix: Issue 904714: heap-use-after-free on sw::Renderer::finishRendering Jun 1, 2019

@miniak miniak changed the title fix: Issue 904714: heap-use-after-free on sw::Renderer::finishRendering fix: Prevent glDeleteQueries from deleting a live Query Jun 1, 2019

@zcbenz

zcbenz approved these changes Jun 2, 2019

@electron-cation electron-cation bot removed the new-pr 🌱 label Jun 2, 2019

@miniak miniak added the security 🔒 label Jun 3, 2019

@miniak miniak added the backport label Jun 3, 2019

@zcbenz zcbenz merged commit bbeedaf into 4-2-x Jun 4, 2019

12 of 13 checks passed

Valid Backport Invalid Backport
Details
Artifact Comparison No Changes
Details
Semantic Pull Request ready to be squashed
Details
WIP Ready for review
Details
appveyor: win-ia32-testing AppVeyor build succeeded
Details
appveyor: win-ia32-testing-pr AppVeyor build succeeded
Details
appveyor: win-x64-testing AppVeyor build succeeded
Details
appveyor: win-x64-testing-pr AppVeyor build succeeded
Details
build-linux Workflow: build-linux
Details
build-mac Workflow: build-mac
Details
electron-arm-testing Build #20190601.15 succeeded
Details
electron-arm64-testing Build #20190601.16 succeeded
Details
release-notes Release notes found
@release-clerk

This comment has been minimized.

Copy link

commented Jun 4, 2019

Release Notes Persisted

Backported fix https://bugs.chromium.org/p/chromium/issues/detail?id=904714.

@zcbenz zcbenz deleted the miniak/backport-904714-4-2-x branch Jun 4, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.