google / google/shaderc

Null pointer dereference in shaderc SPIR-V assembly handling crashes glslc and API consumers

Open Beginner friendly
#1,597 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
2.2k
Forks
445
Avg merge
11h 6m
Merged PRs (30d)
6

Description

## Summary

`shaderc_assemble_into_spv()` returns a result object with a null internal `spv_binary` when SPIR-V assembly fails, but `shaderc_compilation_result_spv_binary::GetBytes()` unconditionally dereferences it at `libshaderc/src/shaderc_private.h:82`. Every caller that reads result bytes on a failed assembly crashes: the `glslc` CLI, the C API (`shaderc_result_get_bytes`), and the C++ API (`cbegin()`/`cend()`).

This is a denial-of-service of the compiling process via an attacker-supplied `.spvasm` file or assembly string. No memory corruption beyond the null read occurs, and no data is exposed. A one-line fix is proposed in the linked PR.

## Affected code

- `libshaderc/src/shaderc_private.h:82` — `GetBytes()` derefs `output_data_->code` without checking `output_data_`.
- `libshaderc/src/shaderc.cc:713-751` — `shaderc_assemble_into_spv()` only calls `SetOutputData()` inside the `if (assembling_succeeded)` branch; on failure `output_data_` stays null.
- `glslc/src/file_compiler.cc:182-184` — `EmitCompiledResult` builds a `string_piece` from `result.cbegin()`/`cend()` before checking success (checked later at line 207).
- `libshaderc/include/shaderc/shaderc.hpp:90,98` — `cbegin()`/`cend()` route to `shaderc_result_get_bytes`.

The GLSL-compile result type (`shaderc_compilation_result_vector`) is already null-safe; only the assembly result type is affected.

## Repro

```bash
# 1. Build shaderc (Release or ASAN)
# 2. Invalid assembly input:
printf 'not spv at all\n' > t3.spvasm
# 3. Crash:
glslc t3.spvasm -o /dev/null
# -> SEGV (exit 139 Release; ASAN: null deref at address 0x0)
# 4. C API: shaderc_result_get_bytes() on failed assembly -> SEGV
# 5. Control: valid assembly compiles and exits 0
```

Reported to the Google OSS VRP (g.co/vulnz).

Contributor guide

Open the contributing guide

Research direction

Start with libshaderc/src/shaderc_private.h:82 and trace the failed result from libshaderc/src/shaderc.cc:713-751. Rebuild shaderc, then run the invalid .spvasm reproduction and verify glslc plus the C and C++ result-byte APIs return failure without crashing.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers, security
Issue type
Bug
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
84/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.