Changeset 278296 in webkit

Timestamp:

May 31, 2021, 11:18:35 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Cherry-pick ANGLE: Add array bounds checks for WebGL shaders
​https://bugs.webkit.org/show_bug.cgi?id=226397

Patch by Kimmo Kinnunen <​kkinnunen@apple.com> on 2021-05-31
Reviewed by Dean Jackson.

Cherry-pick ANGLE commit b0d39ba2aba218402ff2f32f6e16f18cf4975ff4
At the moment does not affect any WebKit client.
Makes the code consistent with OpenGL.
Makes it easier to understand same change in Metal backend.

Upstream description:
Add array bounds checks for WebGL shaders
WebGL shaders may contain OOB array accesses which in turn
cause undefined behavior, which may result in security
issues. This was detected as an UNKNOWN READ by UBSAN while
testing with SwANGLE.

• src/libANGLE/renderer/vulkan/ShaderVk.cpp:

(rx::ShaderVk::compile):

Location:

trunk/Source/ThirdParty/ANGLE

Files:

• ChangeLog (modified) (1 diff)
• src/libANGLE/renderer/vulkan/ShaderVk.cpp (modified) (1 diff)

trunk/Source/ThirdParty/ANGLE/ChangeLog

@@ +1 @@
+2021-05-31  Kimmo Kinnunen  <kkinnunen@apple.com>
+
+        Cherry-pick ANGLE: Add array bounds checks for WebGL shaders
+        https://bugs.webkit.org/show_bug.cgi?id=226397
+
+        Reviewed by Dean Jackson.
+
+        Cherry-pick ANGLE commit b0d39ba2aba218402ff2f32f6e16f18cf4975ff4
+        At the moment does not affect any WebKit client.
+        Makes the code consistent with OpenGL.
+        Makes it easier to understand same change in Metal backend.
+
+        Upstream description:
+        Add array bounds checks for WebGL shaders
+        WebGL shaders may contain OOB array accesses which in turn
+        cause undefined behavior, which may result in security
+        issues. This was detected as an UNKNOWN READ by UBSAN while
+        testing with SwANGLE.
+
+        * src/libANGLE/renderer/vulkan/ShaderVk.cpp:
+        (rx::ShaderVk::compile):
+
 2021-05-28  Kimmo Kinnunen  <kkinnunen@apple.com>
 

trunk/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ShaderVk.cpp

@@ -37 +37 @@
         // Extra initialization in spirv shader may affect performance.
         compileOptions |= SH_INITIALIZE_UNINITIALIZED_LOCALS;
+
+        // WebGL shaders may contain OOB array accesses which in turn cause undefined behavior,
+        // which may result in security issues. See https://crbug.com/1189110.
+        compileOptions |= SH_CLAMP_INDIRECT_ARRAY_BOUNDS;
 
         if (mState.getShaderType() != gl::ShaderType::Compute)