Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Fixed all OOB accesses in VertexProgram and PixelProgram #18567

Merged
merged 1 commit into from Jun 7, 2019

Conversation

@miniak
Copy link
Contributor

commented Jun 1, 2019

Description of Change

Backport fixes for:

https://swiftshader.googlesource.com/SwiftShader.git/+/0e6a044dff9facf499739be93536bd7f7cc4c6bf

Fix undefined behavior in OFFSET().

Accessing members of a null pointer is undefined behavior, even when
only used to obtain the address again. So use a non-zero value as the
base pointer address instead. 32 was chosen to provide sufficient
alignment guarantees.

https://swiftshader.googlesource.com/SwiftShader.git/+/48d47a4912684bfa4d23d3cdaab60046bf3d0468

Fixed all OOB accesses in VertexProgram and PixelProgram

A lot of arrays in VertexProgram and PixelProgram have fixed sizes,
so programs that have more nested loops or ifs or deeper call stacks
can cause OOB accesses, which causes security issues in Chromium.

Index clamping was added to prevent any OOB memory accesses here.

This could eventually be fixed properly by first verifying these sizes
and giving shader compile errors when these limits are exceeded.

/cc @electron/wg-security

Checklist

Release Notes

Notes: Backported fix for: https://bugs.chromium.org/p/chromium/issues/detail?id=915197, https://bugs.chromium.org/p/chromium/issues/detail?id=915206 and https://bugs.chromium.org/p/chromium/issues/detail?id=915218.

@miniak miniak added the 4-2-x label Jun 1, 2019

@miniak miniak requested a review from electron/wg-security Jun 1, 2019

@miniak miniak self-assigned this Jun 1, 2019

@miniak miniak force-pushed the miniak/backport-swiftshader-4-2-x branch from 80df447 to 9c684d0 Jun 1, 2019

@deepak1556
Copy link
Member

left a comment

Marking it for fixing the compilation errors.

@miniak miniak force-pushed the miniak/backport-swiftshader-4-2-x branch from 9c684d0 to 25aae40 Jun 5, 2019

@miniak miniak force-pushed the miniak/backport-swiftshader-4-2-x branch from 25aae40 to 5001b8d Jun 5, 2019

@miniak miniak requested review from deepak1556 and zcbenz and removed request for deepak1556 Jun 6, 2019

@zcbenz
zcbenz approved these changes Jun 6, 2019
@miniak

This comment has been minimized.

Copy link
Contributor Author

commented Jun 6, 2019

@deepak1556 I've fixed the build error

@zcbenz zcbenz merged commit 87c0b54 into 4-2-x Jun 7, 2019

12 of 13 checks passed

Valid Backport Invalid Backport
Details
Artifact Comparison No Changes
Details
Semantic Pull Request ready to be squashed
Details
WIP Ready for review
Details
appveyor: win-ia32-testing AppVeyor build succeeded
Details
appveyor: win-ia32-testing-pr AppVeyor build succeeded
Details
appveyor: win-x64-testing AppVeyor build succeeded
Details
appveyor: win-x64-testing-pr AppVeyor build succeeded
Details
build-linux Workflow: build-linux
Details
build-mac Workflow: build-mac
Details
electron-arm-testing Build #20190605.17 succeeded
Details
electron-arm64-testing Build #20190605.17 succeeded
Details
release-notes Release notes found

@zcbenz zcbenz deleted the miniak/backport-swiftshader-4-2-x branch Jun 7, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
3 participants
You can’t perform that action at this time.