KhronosGroup / KhronosGroup/WebGL

Robust buffer access should allow us to read outside buffer bounds, but a missing buffer should still be UB

Open
#3,297 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
2.9k
Forks
703
Avg merge
2d 9h
Merged PRs (30d)
4

Description

ANGLE ran into an Android app that expected this to not generate an error.

On call `ValidateProgramDrawStates`, attempting validation through buffer access validation alone was insufficient and produced a runtime error.
```
size_t uniformBufferSize = GetBoundBufferAvailableSize(uniformBuffer);
if (uniformBufferSize < uniformBlock.dataSize && context->isBufferAccessValidationEnabled()))
{
// undefined behaviour
return gl::err::kUniformBufferTooSmall;
}
```

The addition of a webgl check was necessary to run correctly.
```
--- if (uniformBufferSize < uniformBlock.dataSize && context->isBufferAccessValidationEnabled()))
+++ if (uniformBufferSize < uniformBlock.dataSize &&
+++ (context->isWebGL() || context->isBufferAccessValidationEnabled()))
```

My understanding is that this is in conflict with the spec. This bug was found with help from @null77

For reference the app was Runescape Mobile.

Contributor guide

Open the contributing guide

Research direction

Read ValidateProgramDrawStates and the shown GetBoundBufferAvailableSize check first; compare the behavior with the relevant WebGL buffer-access rules. Done means robust access can read beyond buffer bounds without an error, while a missing buffer remains undefined behavior, with validation behavior confirmed for the Runescape Mobile case.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, cpp
Domain
web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.