KhronosGroup / KhronosGroup/glslang

[compile_fuzzer] Crashing case in `handleFunctionArgument`

Open
#4,093 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
3.6k
Forks
989
Avg merge
1d 2h
Merged PRs (30d)
31

Description

Hi, we found a crashing test case when testing glslang by the fuzzing driver from oss-fuzz: https://github.com/google/oss-fuzz/blob/913344964bc1ebd3801cf8b2e24966ab4d2e836a/projects/glslang/compile_fuzzer.cc

The glslang commit version: 7099c123729e02f81d70559e79ee4360096fdfe5

Build flags: make install glslang based on README and build the fuzzing driver by:
```sh
cd install/
clang++ -fsanitize=fuzzer,address ./compile_fuzzer.cc -DENABLE_HLSL -DENABLE_OPT=0 -DGLSLANG_OSINCLUDE_UNIX -I ./include/ ./lib/libglslang.a ./lib/libSPIRV.a ./lib/libglslang-default-resource-limits.a -o ./compile_fuzzer
```

The PoC
```
sampler a=o(0++
```

Running `./compile_fuzzer ./poc` results in:
(It would not 100% reproduce stably and I'm not sure why)
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==538364==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x564c08d75366 bp 0x7ffe14f12170 sp 0x7ffe14f12120 T0)
==538364==The signal is caused by a READ memory access.
==538364==Hint: address points to the zero page.
#0 0x564c08d75366 in glslang::HlslParseContext::handleFunctionArgument(glslang::TFunction*, glslang::TIntermTyped*&, glslang::TIntermTyped*) glslang/HLSL/hlslParseHelper.cpp:2481:44
#1 0x564c08dcca1b in glslang::HlslGrammar::acceptArguments(glslang::TFunction*, glslang::TIntermTyped*&) glslang/HLSL/hlslGrammar.cpp:3616:44
#2 0x564c08dcc902 in glslang::HlslGrammar::acceptFunctionCall(glslang::TSourceLoc const&, std::__cxx11::basic_string, glslang::pool_allocator >&, glslang::TIntermTyped*&, glslang::TIntermTyped*) glslang/HLSL/hlslGrammar.cpp:3583:26
#3 0x564c08dcc104 in glslang::HlslGrammar::acceptPostfixExpression(glslang::TIntermTyped*&) glslang/HLSL/hlslGrammar.cpp:3426:38
#4 0x564c08dcbd4c in glslang::HlslGrammar::acceptUnaryExpression(glslang::TIntermTyped*&) glslang/HLSL/hlslGrammar.cpp:3350:39
#5 0x564c08dcb878 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3254:37
#6 0x564c08dcb898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#7 0x564c08dcb898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#8 0x564c08dcb898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#9 0x564c08dcb898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#10 0x564c08dcb898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#11 0x564c08dcb898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#12 0x564c08dcb898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#13 0x564c08dcb898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#14 0x564c08dcb898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#15 0x564c08dcb898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#16 0x564c08dcb898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#17 0x564c08dcb66c in glslang::HlslGrammar::acceptConditionalExpression(glslang::TIntermTyped*&) glslang/HLSL/hlslGrammar.cpp:3204:33
#18 0x564c08dcb49b in glslang::HlslGrammar::acceptAssignmentExpression(glslang::TIntermTyped*&) glslang/HLSL/hlslGrammar.cpp:3158:38
#19 0x564c08dc1eeb in glslang::HlslGrammar::acceptDeclaration(TIntermNode*&) glslang/HLSL/hlslGrammar.cpp:480:49
#20 0x564c08dc0f94 in glslang::HlslGrammar::acceptDeclarationList(TIntermNode*&) glslang/HLSL/hlslGrammar.cpp:165:32
#21 0x564c08dc0e43 in glslang::HlslGrammar::acceptCompilationUnit() glslang/HLSL/hlslGrammar.cpp:130:32
#22 0x564c08dc0bbb in glslang::HlslGrammar::parse() glslang/HLSL/hlslGrammar.cpp:66:33
#23 0x564c08d686c3 in glslang::HlslParseContext::parseShaderStrings(glslang::TPpContext&, glslang::TInputScanner&, bool) glslang/HLSL/hlslParseHelper.cpp:132:23
#24 0x564c08cd6460 in (anonymous namespace)::DoFullParse::operator()(glslang::TParseContextBase&, glslang::TPpContext&, glslang::TInputScanner&, bool, glslang::TSymbolTable&, glslang::TIntermediate&, EShOptimizationLevel, EShMessages) glslang/MachineIndependent/ShaderLang.cpp:1233:46
#25 0x564c08cdbf73 in bool (anonymous namespace)::ProcessDeferred<(anonymous namespace)::DoFullParse>(TCompiler*, char const* const*, int, int const*, char const* const*, char const*, EShOptimizationLevel, TBuiltInResource const*, int, EProfile, bool, int, bool, EShMessages, glslang::TIntermediate&, (anonymous namespace)::DoFullParse&, bool, glslang::TShader::Includer&, std::__cxx11::basic_string, std::allocator >, glslang::TEnvironment const*, bool) glslang/MachineIndependent/ShaderLang.cpp:1008:37
#26 0x564c08cd67f7 in (anonymous namespace)::CompileDeferred(TCompiler*, char const* const*, int, int const*, char const* const*, char const*, EShOptimizationLevel, TBuiltInResource const*, int, EProfile, bool, int, bool, EShMessages, glslang::TIntermediate&, glslang::TShader::Includer&, std::__cxx11::basic_string, std::allocator >, glslang::TEnvironment*, bool) glslang/MachineIndependent/ShaderLang.cpp:1321:27
#27 0x564c08cd82da in glslang::TShader::parse(TBuiltInResource const*, int, EProfile, bool, bool, EShMessages, glslang::TShader::Includer&) glslang/MachineIndependent/ShaderLang.cpp:1893:27
#28 0x564c08cd2a5c in glslang::TShader::parse(TBuiltInResource const*, int, EProfile, bool, bool, EShMessages) install2/./include/glslang/Public/ShaderLang.h:679:16
#29 0x564c08cd2882 in glslang::TShader::parse(TBuiltInResource const*, int, bool, EShMessages) install2/./include/glslang/Public/ShaderLang.h:685:16
#30 0x564c08cd261b in LLVMFuzzerTestOneInput install2/./fuzzer.cc:17:10
```

Contributor guide

Open the contributing guide

Research direction

Start with glslang/HLSL/hlslParseHelper.cpp at handleFunctionArgument line 2481, then trace the call from hlslGrammar.cpp:3616. Build the compile_fuzzer with the listed flags and run it against the PoC under AddressSanitizer; done means the input no longer causes the reported null-pointer crash.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.