wgpu
wgpu copied to clipboard
[naga] Detected panics during fuzzing
Description I did fuzz runs with naga fuzz targets with Rust overflow checks enabled and detected numerous different panics/issues:
- glsl_parser
naga/src/front/glsl/offset.rs:88:53attempt to multiply with overflownaga/src/front/mod.rs:76:25index out of bounds: the len is 2 but the index is 3naga/src/proc/constant_evaluator.rs:404:19index out of bounds: the len is 1 but the index is 1naga/src/proc/mod.rs:495:20index out of bounds: the len is 0 but the index is 0naga/src/proc/type_methods.rs:218:17attempt to multiply with overflowUNKNOWNstack overflow
- ir
naga/src/proc/constant_evaluator.rs:404:19index out of bounds: the len is 0 but the index is 0 (see glsl_parser)naga/naga/src/proc/type_methods.rs:218:17attempt to multiply with overflow (see glsl_parser/spv_parser)naga/src/proc/typifier.rs:445:44index out of bounds: the len is 0 but the index is 0naga/src/proc/typifier.rs:745:44index out of bounds: the len is 0 but the index is 0naga/src/valid/analyzer.rs:1169:83index out of bounds: the len is 1 but the index is 62naga/src/valid/expression.rs:1093:30index out of bounds: the len is 0 but the index is 3324497870naga/src/valid/interface.rs:693:72internal error: entered unreachable codenaga/src/valid/type.rs:676:36attempt to subtract with overflowUNKNOWNstack overflow
- spv_parser
naga/src/front/spv/mod.rs:4854:42index out of bounds: the len is 0 but the index is 0naga/src/front/spv/mod.rs:4854:51index out of bounds: the len is 1 but the index is 1naga/src/front/spv/mod.rs:4854:60index out of bounds: the len is 2 but the index is 2naga/src/front/spv/mod.rs:5229:47calledResult::unwrap()on anErrvalue: LayoutErrornaga/src/front/spv/mod.rs:5310:47calledResult::unwrap()on anErrvalue: LayoutErrornaga/src/front/spv/mod.rs:5361:47calledResult::unwrap()on anErrvalue: LayoutErrornaga/src/front/spv/mod.rs:5393:13attempt to add with overflownaga/src/proc/type_methods.rs:218:17attempt to multiply with overflow (see glsl_parser/ir)
I tried to search through the existing issues to avoid duplicates. Sorry if I missed something.
Repro steps I have attached an archive with the example input files that lead to the respective crash generated by the fuzzer. (see "Extra materials")
Expected vs observed behavior The code should not panic/crash.
Extra materials naga_panic_inputs.zip
Platform
Commit f04391d916d4cc34ca85944f27f2e050c14f56c3. My test environment is based on Ubuntu Linux 22.04 and Rust v1.86.0.