KhronosGroup / KhronosGroup/glslang

[compile_fuzzer] Crashing case in `addBinaryMath`

Open
#4,094 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
3.6k
Forks
989
Avg merge
1d 2h
Merged PRs (30d)
31

Description

Hi, we found a crashing test case when testing glslang by the fuzzing driver from oss-fuzz: https://github.com/google/oss-fuzz/blob/913344964bc1ebd3801cf8b2e24966ab4d2e836a/projects/glslang/compile_fuzzer.cc

The glslang commit version: 7099c123729e02f81d70559e79ee4360096fdfe5

Build flags: make install glslang based on README and build the fuzzing driver by:
```sh
cd install/
clang++ -fsanitize=fuzzer,address ./compile_fuzzer.cc -DENABLE_HLSL -DENABLE_OPT=0 -DGLSLANG_OSINCLUDE_UNIX -I ./include/ ./lib/libglslang.a ./lib/libSPIRV.a ./lib/libglslang-default-resource-limits.a -o ./compile_fuzzer
```

The PoC
```
void a()a=0+(d.x?0[0]:r)
```

Running `./compile_fuzzer ./poc` results in:
(It would not 100% reproduce stably and I'm not sure why)
```
=================================================================
==550497==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55c73df66f3b bp 0x7ffe6646d7a0 sp 0x7ffe6646d660 T0)
==550497==The signal is caused by a READ memory access.
==550497==Hint: address points to the zero page.
#0 0x55c73df66f3b in glslang::TIntermediate::addBinaryMath(glslang::TOperator, glslang::TIntermTyped*, glslang::TIntermTyped*, glslang::TSourceLoc const&) glslang/MachineIndependent/Intermediate.cpp:121:69
#1 0x55c73df0e97a in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3277:42
#2 0x55c73df0e898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#3 0x55c73df0e898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#4 0x55c73df0e898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#5 0x55c73df0e898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#6 0x55c73df0e898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#7 0x55c73df0e898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#8 0x55c73df0e898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#9 0x55c73df0e898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#10 0x55c73df0e898 in glslang::HlslGrammar::acceptBinaryExpression(glslang::TIntermTyped*&, glslang::PrecedenceLevel) glslang/HLSL/hlslGrammar.cpp:3257:33
#11 0x55c73df0e66c in glslang::HlslGrammar::acceptConditionalExpression(glslang::TIntermTyped*&) glslang/HLSL/hlslGrammar.cpp:3204:33
#12 0x55c73df0e49b in glslang::HlslGrammar::acceptAssignmentExpression(glslang::TIntermTyped*&) glslang/HLSL/hlslGrammar.cpp:3158:38
#13 0x55c73df04eeb in glslang::HlslGrammar::acceptDeclaration(TIntermNode*&) glslang/HLSL/hlslGrammar.cpp:480:49
#14 0x55c73df03f94 in glslang::HlslGrammar::acceptDeclarationList(TIntermNode*&) glslang/HLSL/hlslGrammar.cpp:165:32
#15 0x55c73df03e43 in glslang::HlslGrammar::acceptCompilationUnit() glslang/HLSL/hlslGrammar.cpp:130:32
#16 0x55c73df03bbb in glslang::HlslGrammar::parse() glslang/HLSL/hlslGrammar.cpp:66:33
#17 0x55c73deab6c3 in glslang::HlslParseContext::parseShaderStrings(glslang::TPpContext&, glslang::TInputScanner&, bool) glslang/HLSL/hlslParseHelper.cpp:132:23
#18 0x55c73de19460 in (anonymous namespace)::DoFullParse::operator()(glslang::TParseContextBase&, glslang::TPpContext&, glslang::TInputScanner&, bool, glslang::TSymbolTable&, glslang::TIntermediate&, EShOptimizationLevel, EShMessages) glslang/MachineIndependent/ShaderLang.cpp:1233:46
#19 0x55c73de1ef73 in bool (anonymous namespace)::ProcessDeferred<(anonymous namespace)::DoFullParse>(TCompiler*, char const* const*, int, int const*, char const* const*, char const*, EShOptimizationLevel, TBuiltInResource const*, int, EProfile, bool, int, bool, EShMessages, glslang::TIntermediate&, (anonymous namespace)::DoFullParse&, bool, glslang::TShader::Includer&, std::__cxx11::basic_string, std::allocator >, glslang::TEnvironment const*, bool) glslang/MachineIndependent/ShaderLang.cpp:1008:37
#20 0x55c73de197f7 in (anonymous namespace)::CompileDeferred(TCompiler*, char const* const*, int, int const*, char const* const*, char const*, EShOptimizationLevel, TBuiltInResource const*, int, EProfile, bool, int, bool, EShMessages, glslang::TIntermediate&, glslang::TShader::Includer&, std::__cxx11::basic_string, std::allocator >, glslang::TEnvironment*, bool) glslang/MachineIndependent/ShaderLang.cpp:1321:27
#21 0x55c73de1b2da in glslang::TShader::parse(TBuiltInResource const*, int, EProfile, bool, bool, EShMessages, glslang::TShader::Includer&) glslang/MachineIndependent/ShaderLang.cpp:1893:27
#22 0x55c73de15a5c in glslang::TShader::parse(TBuiltInResource const*, int, EProfile, bool, bool, EShMessages) install2/./include/glslang/Public/ShaderLang.h:679:16
#23 0x55c73de15882 in glslang::TShader::parse(TBuiltInResource const*, int, bool, EShMessages) install2/./include/glslang/Public/ShaderLang.h:685:16
#24 0x55c73de1561b in LLVMFuzzerTestOneInput install2/./fuzzer.cc:17:10
```

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash with the provided PoC and fuzzing-driver build, then inspect glslang/MachineIndependent/Intermediate.cpp at addBinaryMath line 121 and glslang/HLSL/hlslGrammar.cpp around acceptBinaryExpression line 3277. Done means the input no longer causes the reported AddressSanitizer SEGV while preserving the expected parsing behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.