Title: [278296] trunk/Source/ThirdParty/ANGLE
- Revision
- 278296
- Author
- [email protected]
- Date
- 2021-05-31 23:18:35 -0700 (Mon, 31 May 2021)
Log Message
Cherry-pick ANGLE: Add array bounds checks for WebGL shaders
https://bugs.webkit.org/show_bug.cgi?id=226397
Patch by Kimmo Kinnunen <[email protected]> on 2021-05-31
Reviewed by Dean Jackson.
Cherry-pick ANGLE commit b0d39ba2aba218402ff2f32f6e16f18cf4975ff4
At the moment does not affect any WebKit client.
Makes the code consistent with OpenGL.
Makes it easier to understand same change in Metal backend.
Upstream description:
Add array bounds checks for WebGL shaders
WebGL shaders may contain OOB array accesses which in turn
cause undefined behavior, which may result in security
issues. This was detected as an UNKNOWN READ by UBSAN while
testing with SwANGLE.
* src/libANGLE/renderer/vulkan/ShaderVk.cpp:
(rx::ShaderVk::compile):
Modified Paths
Diff
Modified: trunk/Source/ThirdParty/ANGLE/ChangeLog (278295 => 278296)
--- trunk/Source/ThirdParty/ANGLE/ChangeLog 2021-06-01 04:52:51 UTC (rev 278295)
+++ trunk/Source/ThirdParty/ANGLE/ChangeLog 2021-06-01 06:18:35 UTC (rev 278296)
@@ -1,3 +1,25 @@
+2021-05-31 Kimmo Kinnunen <[email protected]>
+
+ Cherry-pick ANGLE: Add array bounds checks for WebGL shaders
+ https://bugs.webkit.org/show_bug.cgi?id=226397
+
+ Reviewed by Dean Jackson.
+
+ Cherry-pick ANGLE commit b0d39ba2aba218402ff2f32f6e16f18cf4975ff4
+ At the moment does not affect any WebKit client.
+ Makes the code consistent with OpenGL.
+ Makes it easier to understand same change in Metal backend.
+
+ Upstream description:
+ Add array bounds checks for WebGL shaders
+ WebGL shaders may contain OOB array accesses which in turn
+ cause undefined behavior, which may result in security
+ issues. This was detected as an UNKNOWN READ by UBSAN while
+ testing with SwANGLE.
+
+ * src/libANGLE/renderer/vulkan/ShaderVk.cpp:
+ (rx::ShaderVk::compile):
+
2021-05-28 Kimmo Kinnunen <[email protected]>
ANGLE Metal translator should always collect variables
Modified: trunk/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ShaderVk.cpp (278295 => 278296)
--- trunk/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ShaderVk.cpp 2021-06-01 04:52:51 UTC (rev 278295)
+++ trunk/Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ShaderVk.cpp 2021-06-01 06:18:35 UTC (rev 278296)
@@ -37,6 +37,10 @@
// Extra initialization in spirv shader may affect performance.
compileOptions |= SH_INITIALIZE_UNINITIALIZED_LOCALS;
+ // WebGL shaders may contain OOB array accesses which in turn cause undefined behavior,
+ // which may result in security issues. See https://crbug.com/1189110.
+ compileOptions |= SH_CLAMP_INDIRECT_ARRAY_BOUNDS;
+
if (mState.getShaderType() != gl::ShaderType::Compute)
{
compileOptions |= SH_INIT_OUTPUT_VARIABLES;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
