Fix CVE-2025-3010: Null pointer dereference in isConversionAllowed#4169
Fix CVE-2025-3010: Null pointer dereference in isConversionAllowed#4169cnDelbert wants to merge 2 commits intoKhronosGroup:mainfrom
Conversation
Added a null check for 'node' in TIntermediate::isConversionAllowed to prevent a null pointer dereference when processing malformed HLSL conditional expressions. This addresses the vulnerability reported in CVE-2025-3010 where a crafted shader could cause a crash due to missing validation before accessing node->getBasicType(). References: - CVE-2025-3010 - KhronosGroup#3903
|
|
arcady-lunarg
left a comment
arcady-lunarg
left a comment
There was a problem hiding this comment.
You will need to add your test to one of the lists of tests in gtests/Hlsl.FromFile.cpp and generate an expected test result using build/gtests/glslangtests --update-mode
Added hlsl.cve-2025-3010.frag to gtests/Hlsl.FromFile.cpp and generated the expected result file Test/baseResults/hlsl.cve-2025-3010.frag.out as requested by maintainers.
|
@arcady-lunarg I have added the test case to |
|
Seems like ToSpirv/HlslCompileTest.FromFile/hlsl_cve_2025_3010_frag is failing. Can you please check? Let me know if you need help with upstreaming |
dnovillo
left a comment
dnovillo
left a comment
There was a problem hiding this comment.
The golden output generated starts with Test\. It should not have the path, just the shader name. That seems to be the failure you're getting.
| bool TIntermediate::isConversionAllowed(TOperator op, TIntermTyped* node) const | ||
| { | ||
| if (node == nullptr) | ||
| return false; |
There was a problem hiding this comment.
This seems like it's papering over the issue. The HLSL frontend is generating a nil node and passing it down. While this prevents the crash, it will silently supresses a potential semantic error. Where is this nil pointer generated? That is probably the spot to fix.
There was a problem hiding this comment.
This file seems like a valid HLSL shader? The CVE should produce a nil TIntermTyped*. Do you have the original invalid shader?
|
@sae-as-me Would you please help to fix or provide some shader examples? |
6 participants
Added a null check for 'node' in TIntermediate::isConversionAllowed to prevent a null pointer dereference when processing malformed HLSL conditional expressions.
This addresses the vulnerability reported in CVE-2025-3010 where a crafted shader could cause a crash due to missing validation before accessing node->getBasicType().
References: