KhronosGroup / KhronosGroup/WebGL
Robust buffer access should allow us to read outside buffer bounds, but a missing buffer should still be UB
- Dominant language
- HTML
- Stars
- 2.9k
- Forks
- 703
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 4
Description
ANGLE ran into an Android app that expected this to not generate an error.
On call `ValidateProgramDrawStates`, attempting validation through buffer access validation alone was insufficient and produced a runtime error.
```
size_t uniformBufferSize = GetBoundBufferAvailableSize(uniformBuffer);
if (uniformBufferSize < uniformBlock.dataSize && context->isBufferAccessValidationEnabled()))
{
// undefined behaviour
return gl::err::kUniformBufferTooSmall;
}
```
The addition of a webgl check was necessary to run correctly.
```
--- if (uniformBufferSize < uniformBlock.dataSize && context->isBufferAccessValidationEnabled()))
+++ if (uniformBufferSize < uniformBlock.dataSize &&
+++ (context->isWebGL() || context->isBufferAccessValidationEnabled()))
```
My understanding is that this is in conflict with the spec. This bug was found with help from @null77
For reference the app was Runescape Mobile.
Contributor guide
Research direction
Read ValidateProgramDrawStates and the shown GetBoundBufferAvailableSize check first; compare the behavior with the relevant WebGL buffer-access rules. Done means robust access can read beyond buffer bounds without an error, while a missing buffer remains undefined behavior, with validation behavior confirmed for the Runescape Mobile case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, cpp
- Domain
- web-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100