Null pointer dereference in shaderc SPIR-V assembly handling crashes glslc and API consumers
- Dominant language
- C++
- Stars
- 2.2k
- Forks
- 445
- Avg merge
- 11h 6m
- Merged PRs (30d)
- 6
Description
## Summary
`shaderc_assemble_into_spv()` returns a result object with a null internal `spv_binary` when SPIR-V assembly fails, but `shaderc_compilation_result_spv_binary::GetBytes()` unconditionally dereferences it at `libshaderc/src/shaderc_private.h:82`. Every caller that reads result bytes on a failed assembly crashes: the `glslc` CLI, the C API (`shaderc_result_get_bytes`), and the C++ API (`cbegin()`/`cend()`).
This is a denial-of-service of the compiling process via an attacker-supplied `.spvasm` file or assembly string. No memory corruption beyond the null read occurs, and no data is exposed. A one-line fix is proposed in the linked PR.
## Affected code
- `libshaderc/src/shaderc_private.h:82` — `GetBytes()` derefs `output_data_->code` without checking `output_data_`.
- `libshaderc/src/shaderc.cc:713-751` — `shaderc_assemble_into_spv()` only calls `SetOutputData()` inside the `if (assembling_succeeded)` branch; on failure `output_data_` stays null.
- `glslc/src/file_compiler.cc:182-184` — `EmitCompiledResult` builds a `string_piece` from `result.cbegin()`/`cend()` before checking success (checked later at line 207).
- `libshaderc/include/shaderc/shaderc.hpp:90,98` — `cbegin()`/`cend()` route to `shaderc_result_get_bytes`.
The GLSL-compile result type (`shaderc_compilation_result_vector`) is already null-safe; only the assembly result type is affected.
## Repro
```bash
# 1. Build shaderc (Release or ASAN)
# 2. Invalid assembly input:
printf 'not spv at all\n' > t3.spvasm
# 3. Crash:
glslc t3.spvasm -o /dev/null
# -> SEGV (exit 139 Release; ASAN: null deref at address 0x0)
# 4. C API: shaderc_result_get_bytes() on failed assembly -> SEGV
# 5. Control: valid assembly compiles and exits 0
```
Reported to the Google OSS VRP (g.co/vulnz).
Contributor guide
Research direction
Start with libshaderc/src/shaderc_private.h:82 and trace the failed result from libshaderc/src/shaderc.cc:713-751. Rebuild shaderc, then run the invalid .spvasm reproduction and verify glslc plus the C and C++ result-byte APIs return failure without crashing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- compilers, security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100