Fix null pointer dereference in DependencyInfoDumpingHandler#1546
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
dneto0
left a comment
There was a problem hiding this comment.
The logic looks ok.
Please add a test to https://github.com/google/shaderc/blob/main/glslc/test/option_dash_M.py
Also, please sign the CLA. I can't accept the changes without the CLA.
7cd2913 to
bfdab44
Compare
|
Ah, please rebase against main. |
Add a null check for the return value of GetOutputStream() in dependency_info.cc before dereferencing the stream pointer. When GetOutputStream() fails to open the output file (e.g., due to permission errors, full disk, or non-existent directory), it returns nullptr. The code previously unconditionally dereferenced this pointer, causing a segmentation fault (SIGSEGV). This is the same vulnerability pattern that was fixed in file_compiler.cc (commit 1d97901), but was missed in the dependency_info.cc code path. The fix follows the identical pattern: check the pointer for null before use and return false on failure. Bug: Null pointer dereference when glslc is invoked with -MD flag and the dependency info output file cannot be opened for writing.
Head branch was pushed to by a user without write access
bfdab44 to
0b83c41
Compare
Description
This PR fixes a null pointer dereference vulnerability (SIGSEGV) in
DependencyInfoDumpingHandler::DumpDependencyInfo()that occurs whenglslcis invoked with the-MDflag, and the resulting dependency info output file cannot be opened for writing.Root Cause
When attempting to generate the
.ddependency file in a read-only directory, a non-existent path, or when the disk is full, the utility functionshaderc_util::GetOutputStream()correctly logs an error and returnsnullptr.However, in
glslc/src/dependency_info.cc, the stream pointerdep_file_streamwas dereferenced unconditionally without a null check:This resulted in an immediate segmentation fault (SIGSEGV) and a process crash.
Fix
Added a standard null check to verify
dep_file_streambefore writing to it. If it is null, the handler gracefully returnsfalse. This aligns perfectly with the identical mitigation pattern previously established inglslc/src/file_compiler.cc(e.g. Commit1d9790184b2e8fb726719deac80caaf6374daed7).Testing
We have reproduced the crash locally and verified that with this patch,
glslcnow correctly exits with a graceful error output (exit code 1) instead of crashing when facing unwritable output dependency paths.