Skip to content

Commit 8bcf6c4

Browse files
authored
Fix segfault in SPIR-V header processing in SpirvInstructionHelper (#8428)
The `SpirvInstructionHelper::loadBlob()` method could segfault when calling `m_headerWords.addRange()` if the SPIR-V blob contained insufficient data for the required 5-word header. To reproduce, run ``` ./build/Debug/bin/slangc.exe tests/modules/environment.slang -o tests/modules/environment.slang-module -target spirv -separate-debug-info (0): error 57004: output SPIR-V contains no exported symbols. Please make sure to specify at least one entrypoint. Segmentation fault ``` The error is expected, but the `Segmentation fault` is not. This PR adds the check to ensure the SPIR-V blob has at least `SPV_INDEX_INSTRUCTION_START * sizeof(SpvWord)` bytes (20 bytes minimum) before attempting to process the header words. Related to: #7547
1 parent f3e2675 commit 8bcf6c4

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

source/slang/slang-emit.cpp

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2287,7 +2287,8 @@ class SpirvInstructionHelper
22872287
{
22882288
ComPtr<ISlangBlob> spirvBlob;
22892289
SlangResult res = artifact->loadBlob(ArtifactKeep::Yes, spirvBlob.writeRef());
2290-
if (SLANG_FAILED(res) || !spirvBlob)
2290+
if (SLANG_FAILED(res) || !spirvBlob ||
2291+
spirvBlob->getBufferSize() < SPV_INDEX_INSTRUCTION_START * sizeof(SpvWord))
22912292
return SLANG_FAIL;
22922293

22932294
// Populate the full array of SPIR-V words.

0 commit comments

Comments
 (0)