Skip to content

check filters allocation in parse_id_filter_environment_var - #2083

Merged
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:id-filter-alloc-check
Oct 24, 2026
Merged

charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:id-filter-alloc-check

Conversation

@aizu-m

@aizu-m aizu-m commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

AddressSanitizer, new test Allocation.EnumeratePhysicalDevicesWithIdFilterIntentionalAllocFail against the unpatched loader:

loader_environment.c:600:23: runtime error: store to null pointer of type 'uint32_t' (aka 'unsigned int')
==82382==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
==82382==The signal is caused by a WRITE memory access.
    #0 parse_id_filter_environment_var loader_environment.c:600
    #1 vkEnumeratePhysicalDevices trampoline.c:913

Found while reading the OOM handling added in 9cb1f10. parse_id_filter_environment_var now returns a VkResult and checks the parsing_string allocation. The filters array allocated two statements later is never checked. With VK_LOADER_DEVICE_ID_FILTER, VK_LOADER_VENDOR_ID_FILTER or VK_LOADER_DRIVER_ID_FILTER set, a failed allocation from the instance allocator makes the strtok loop write each parsed begin/end pair to NULL + 8 * token index. check_id_matches_filter_environment_var then reads through the same pointer.

Steps:

  1. Swept every allocation under loader/ for a missing NULL check. This is the only one.
  2. Wrote the test. It sets VK_LOADER_DEVICE_ID_FILTER and sweeps the failing allocation index over vkCreateInstance, vkEnumeratePhysicalDevices and vkEnumeratePhysicalDeviceGroups. It aborts with the trace above.
  3. Added the check, returning VK_ERROR_OUT_OF_HOST_MEMORY. Both trampoline callers already propagate that result. The test now passes and the rest of the ctest run is unchanged.

@ci-tester-lunarg

Copy link
Copy Markdown

User aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

1 similar comment
@ci-tester-lunarg

Copy link
Copy Markdown

User aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

@charles-lunarg charles-lunarg left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Whoops! Thanks for the catch.

I figured thered be a slew of new issues after my big PR to remove alloca - I did get a decent review from claude (which found numerous mistakes) but more eyes is more better after all.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build queued with queue ID 170421.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3908 running.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3908 passed.

@charles-lunarg
charles-lunarg merged commit ddcf945 into KhronosGroup:main Oct 24, 2026
52 checks passed
@aizu-m

aizu-m commented Oct 25, 2026

Copy link
Copy Markdown
Contributor Author

Thanks for merging. Easy one to miss next to the parsing_string check.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants