CVE-2025-11205

High chrome OOB 📄 Reporter bug report 🔧 Commit mapped

Overview

High

Severity

—

CVSS

Exploited ITW

Fixed

Fix Status

ImpactHeap buffer overflow in WebGPU

DescriptionHeap buffer overflow in WebGPU

ComponentWebGPU

Bug ClassOOB

Tracker442444724

Fix commit471c3d7e4b83 (dawn) +107/-47

CISA KEVNot listed

CreditedAtte Kettunen of OUSPG

Disclosed2025-09-30

Changed Functions

Function	Change	Notes
`DAWN_SERIALIZABLE` src/dawn/native/BindingInfo.h	modified
`if` src/dawn/native/BindingInfo.h	modified
`for` src/dawn/native/Pipeline.cpp	modified
`if` src/dawn/native/Pipeline.cpp	modified
`if` src/dawn/native/ShaderModule.cpp	modified
`for` src/dawn/native/ShaderModule.cpp	modified

Files Changed

src/dawn/native/BindingInfo.h
src/dawn/native/Pipeline.cpp
src/dawn/native/ShaderModule.cpp
src/dawn/native/ShaderModule.h

Patch

view commit

From 471c3d7e4b83b98ec8c0d8e2d4b566c3b7f5e43c Mon Sep 17 00:00:00 2001
From: Gregg Tavares <[email protected]>
Date: Wed, 03 Sep 2025 18:52:22 -0700
Subject: [PATCH] Fix Heap-overflow in dawn ReflectEntryPointUsingTint

Note: The operators needed to be added so BindingSlot
can be used in std::set. The needed to be constexpr
so that the static_assert that converting a tint
nonSamplerBindingPoint turns into a dawn nonSamplerBindingPoint.
The clang-format off is needed because clang-format fails
on the code in BindingPoint.h

Change-Id: I1bdc075323a14bda264655e475fe6fdc074ced8a
Bug: 442444724
Fixes: 442444724
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/260455
Reviewed-by: Kai Ninomiya <[email protected]>
Commit-Queue: Gregg Tavares <[email protected]>
Auto-Submit: Gregg Tavares <[email protected]>
---

diff --git a/src/dawn/native/BindingInfo.h b/src/dawn/native/BindingInfo.h
index 8692406..4b51171 100644
--- a/src/dawn/native/BindingInfo.h
+++ b/src/dawn/native/BindingInfo.h
@@ -163,7 +163,27 @@
 #define BINDING_SLOT_MEMBER(X) \
     X(BindGroupIndex, group)   \
     X(BindingNumber, binding)
-DAWN_SERIALIZABLE(struct, BindingSlot, BINDING_SLOT_MEMBER){};
+// clang-format off
+DAWN_SERIALIZABLE(struct, BindingSlot, BINDING_SLOT_MEMBER){
+    constexpr bool operator==(const BindingSlot& rhs) const {
+        return group == rhs.group && binding == rhs.binding;
+    }
+
+    constexpr bool operator!=(const BindingSlot& rhs) const {
+        return !(*this == rhs);
+    }
+
+    constexpr bool operator<(const BindingSlot& rhs) const {
+        if (group < rhs.group) {
+            return true;
+        }
+        if (group > rhs.group) {
+            return false;
+        }
+        return binding < rhs.binding;
+    }
+};
+// clang-format on
 #undef BINDING_SLOT_MEMBER
 
 struct PerStageBindingCounts {
diff --git a/src/dawn/native/Pipeline.cpp b/src/dawn/native/Pipeline.cpp
index 2e67435..909eb09 100644
--- a/src/dawn/native/Pipeline.cpp
+++ b/src/dawn/native/Pipeline.cpp
@@ -28,6 +28,7 @@
 #include "dawn/native/Pipeline.h"
 
 #include <algorithm>
+#include <set>
 #include <utility>
 
 #include "absl/container/flat_hash_set.h"
@@ -43,6 +44,48 @@
 #include "src/utils/numeric.h"
 
 namespace dawn::native {
+
+namespace {
+
+// Number of texture+sampler combinations, computed as 1 for every texture+sampler
+// combination + 1 for every texture used without a sampler that wasn't previously counted.
+// Note: this is only used in compatibility mode.
+uint32_t ComputeNumTextureSamplerCombinations(const dawn::native::EntryPointMetadata& metadata) {
+    // separate sampled from non-sampled and put sampled in set
+    std::set<BindingSlot> sampledTextures;
+    std::set<BindingSlot> sampledExternalTextures;
+    std::vector<BindingSlot> nonSampled;
+    uint32_t numSamplerTexturePairs = 0;
+    uint32_t numSamplerExternalTexturePairs = 0;
+
+    for (const auto& pair : metadata.samplerAndNonSamplerTexturePairs) {
+        const auto& bindingGroupInfoMap = metadata.bindings[BindGroupIndex(pair.texture.group)];
+        const auto it = bindingGroupInfoMap.find(BindingNumber(pair.texture.binding));
+        auto isExternalTexture =
+            it != bindingGroupInfoMap.end() &&
+            std::holds_alternative<ExternalTextureBindingInfo>(it->second.bindingInfo);
+        if (isExternalTexture) {
+            ++numSamplerExternalTexturePairs;
+            sampledExternalTextures.insert(pair.texture);
+        } else if (pair.sampler == EntryPointMetadata::nonSamplerBindingPoint) {
+            nonSampled.push_back(pair.texture);
+        } else {
+            ++numSamplerTexturePairs;
+            sampledTextures.insert(pair.texture);
+        }
+    }
+
+    // count the number of non-sampled that are not referenced by sampled pairs.
+    auto numNonSampled = std::count_if(nonSampled.begin(), nonSampled.end(),
+                                       [&](const BindingSlot& nonSampledBindingPoint) {
+                                           return !sampledTextures.contains(nonSampledBindingPoint);
+                                       });
+    return numSamplerTexturePairs + numNonSampled + numSamplerExternalTexturePairs * 3 +
+           sampledExternalTextures.size();
+}
+
+}  // namespace
+
 ResultOrError<ShaderModuleEntryPoint> ValidateProgrammableStage(DeviceBase* device,
                                                                 const ShaderModuleBase* module,
                                                                 StringView entryPointName,
@@ -103,11 +146,12 @@
     const CombinedLimits& limits = device->GetLimits();
     uint32_t maxCombos =
         std::min(limits.v1.maxSampledTexturesPerShaderStage, limits.v1.maxSamplersPerShaderStage);
+    uint32_t numTextureSamplerCombinations = ComputeNumTextureSamplerCombinations(metadata);
     DAWN_INVALID_IF(
-        device->IsCompatibilityMode() && metadata.numTextureSamplerCombinations > maxCombos,
+        device->IsCompatibilityMode() && numTextureSamplerCombinations > maxCombos,
         "Entry-point uses %u texture+sampler combinations which is more than the maximum of %u "
         "combinations in compatibility mode",
-        metadata.numTextureSamplerCombinations, maxCombos);
+        numTextureSamplerCombinations, maxCombos);
 
     // Validate if overridable constants exist in shader module
     // pipelineBase is not yet constructed at this moment so iterate constants from descriptor
diff --git a/src/dawn/native/ShaderModule.cpp b/src/dawn/native/ShaderModule.cpp
index b5e8a92..67cc22b 100644
--- a/src/dawn/native/ShaderModule.cpp
+++ b/src/dawn/native/ShaderModule.cpp
@@ -29,7 +29,6 @@
 
 #include <algorithm>
 #include <limits>
-#include <set>
 #include <sstream>
 #include <utility>
 
@@ -1324,44 +1323,6 @@
 
     metadata->usesSubgroupMatrix = entryPoint.uses_subgroup_matrix;
 
-    // Compute the texture+sampler combination count.
-    if (deviceInfo.isCompatibilityMode) {
-        // separate sampled from non-sampled and put sampled in set
-        std::set<tint::BindingPoint> sampledTextures;
-        std::set<tint::BindingPoint> sampledExternalTextures;
-        std::vector<tint::BindingPoint> nonSampled;
-        uint32_t numSamplerTexturePairs = 0;
-        uint32_t numSamplerExternalTexturePairs = 0;
-
-        for (const auto& pair : samplerAndNonSamplerTextureUses) {
-            const auto& bindingGroupInfoMap =
-                metadata->bindings[BindGroupIndex(pair.texture_binding_point.group)];
-            const auto it =
-                bindingGroupInfoMap.find(BindingNumber(pair.texture_binding_point.binding));
-            auto isExternalTexture =
-                std::holds_alternative<ExternalTextureBindingInfo>(it->second.bindingInfo);
-            if (isExternalTexture) {
-                ++numSamplerExternalTexturePairs;
-                sampledExternalTextures.insert(pair.texture_binding_point);
-            } else if (pair.sampler_binding_point == tintNonSamplerBindingPoint) {
-                nonSampled.push_back(pair.texture_binding_point);
-            } else {
-                ++numSamplerTexturePairs;
-                sampledTextures.insert(pair.texture_binding_point);
-            }
-        }
-
-        // count the number of non-sampled that are not referenced by sampled pairs.
-        auto numNonSampled =
-            std::count_if(nonSampled.begin(), nonSampled.end(),
-                          [&](const tint::BindingPoint& nonSampledBindingPoint) {
-                              return !sampledTextures.contains(nonSampledBindingPoint);
-                          });
-        metadata->numTextureSamplerCombinations = numSamplerTexturePairs + numNonSampled +
-                                                  numSamplerExternalTexturePairs * 3 +
-                                                  sampledExternalTextures.size();
-    }
-
 #undef DelayedInvalidIf
     return std::move(metadata);
 }
diff --git a/src/dawn/native/ShaderModule.h b/src/dawn/native/ShaderModule.h
index a70f61a..0ec26d6 100644
--- a/src/dawn/native/ShaderModule.h
+++ b/src/dawn/native/ShaderModule.h
@@ -329,11 +329,7 @@
     X(bool, usesDepthTextureWithNonComparisonSampler)                                             \
     X(bool, usesSubgroupMatrix)                                                                   \
     /* Immediate Data block byte size */                                                          \
-    X(uint32_t, immediateDataRangeByteSize)                                                       \
-    /* Number of texture+sampler combinations, computed as 1 for every texture+sampler         */ \
-    /* combination + 1 for every texture used without a sampler that wasn't previously counted.*/ \
-    /* Note: this is only set in compatibility mode.                                           */ \
-    X(uint32_t, numTextureSamplerCombinations)

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/src/dawn/tests/unittests/validation/CompatValidationTests.cpp b/src/dawn/tests/unittests/validation/CompatValidationTests.cpp
index c163322..e3cf581 100644
--- a/src/dawn/tests/unittests/validation/CompatValidationTests.cpp
+++ b/src/dawn/tests/unittests/validation/CompatValidationTests.cpp
@@ -256,6 +256,45 @@
     }
 }
 
+// Test that large group ids don't crash
+TEST_F(CompatValidationTest, LargeGroupIds) {
+    wgpu::ShaderModule module = utils::CreateShaderModule(device, R"(
+@group(0) @binding(0) var smp: sampler;
+@group(2345) @binding(0) var tex1: texture_2d<f32>;
+@group(6789) @binding(0) var tex2: texture_2d<f32>;
+
+@vertex fn vs() -> @builtin(position) vec4f {
+    let c = textureLoad(tex1, vec2u(0), 0) + textureLoad(tex2, vec2u(0), 0);
+    return c;
+}
+
+@fragment fn fs() -> @location(0) vec4f {
+    let c = textureSample(tex1, smp, vec2f(0)) + textureSample(tex2, smp, vec2f(0));
+    return c;
+}
+
+@compute @workgroup_size(1) fn main() {
+    let c = textureSampleLevel(tex1, smp, vec2f(0), 0) + textureSampleLevel(tex2, smp, vec2f(0), 0);
+})");
+
+    {
+        wgpu::ComputePipelineDescriptor pDesc;
+        pDesc.compute.module = module;
+        ASSERT_DEVICE_ERROR(device.CreateComputePipeline(&pDesc),
+                            testing::HasSubstr("exceeds maxBindGroups"));
+    }
+    {
+        utils::ComboRenderPipelineDescriptor pDesc;
+        pDesc.vertex.module = module;
+        pDesc.cFragment.module = module;
+        pDesc.cFragment.targetCount = 1;
+        pDesc.cTargets[0].format = wgpu::TextureFormat::RGBA8Unorm;
+
+        ASSERT_DEVICE_ERROR(device.CreateRenderPipeline(&pDesc),
+                            testing::HasSubstr("exceeds maxBindGroups"));
+    }
+}
+
 TEST_F(CompatValidationTest, CanNotCreatePipelineWithDepthTextureUsedWithNonComparisonSampler) {
     wgpu::ShaderModule module = utils::CreateShaderModule(device, R"(
         @group(1) @binding(0) var s: sampler;

Loading diff…

Original Bug Report

reported by [email protected]

Heap-buffer-overflow/wild-read in dawn::native::`anonymous namespace'::ReflectEntryPointUsingTint

Tested on: Chromium: 141.0.7379.0 (Developer Build) (64-bit) OS: Windows 11 Version 24H2 (Build 26100.4946)

GPU-info: Integrated AMD Radeon Graphics of AMD Ryzen 5 5625U

To reproduce run attached .html with ‘–enable-experimental-web-platform-features’ flag.

chromium-141.0.7379.0-win64-asan\chrome.exe –enable-experimental-web-platform-features heap-buffer-overflow-dawnnativeReflectEntryPointUsingTint.html

Reproduces also on Ubuntu 22.04 with ‘–enable-unsafe-webgpu’, but doesn’t require ‘–enable-experimental-web-platform-features’.

ASAN-trace:

==18232==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x1207e5f47bc0 at pc 0x7ffd880d6c79 bp 0x000893ffd030 sp 0x000893ffd078 READ of size 8 at 0x1207e5f47bc0 thread T0 SCARINESS: 33 (8-byte-read-heap-buffer-overflow-far-from-bounds) #0 0x7ffd880d6c78 in absl::container_internal::raw_hash_set<absl::container_internal::FlatHashMapPolicy<unsigned int,dawn::native::ShaderBindingInfo>,absl::hash_internal::Hash<unsigned int>,std::__Cr::equal_to<unsigned int>,std::__Cr::allocator<std::_Cr::pair<const unsigned int,dawn::native::ShaderBindingInfo> > >::find<unsigned int> C:\b\s\w\ir\cache\builder\src\third party\abseil-cpp\absl\container\internal\raw_hash_set.h:2815 #1 0x7ffd880ce340 in dawn::native::anonymous namespace'::ReflectEntryPointUsingTint C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\ShaderModule.cpp:1316 #2 0x7ffd880bbe2c in dawn::native::ParseShaderModule C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\ShaderModule.cpp:1571 #3 0x7ffd87f69109 in dawn::native::LoadOrRun<dawn::Result<dawn::native::ShaderModuleParseResult,dawn::native::ErrorData> (*)(dawn::native::Blob),dawn::Result<dawn::native::ShaderModuleParseResult,dawn::native::ErrorData> (*)(dawn::native::ShaderModuleParseRequest)> C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\CacheRequest.h:165 #4 0x7ffd87f33d7b in dawn::native::DeviceBase::CreateShaderModule C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Device.cpp:2231 #5 0x7ffd87f49789 in dawn::native::DeviceBase::APICreateShaderModule C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Device.cpp:1448 #6 0x7ffd9dc610bd in dawn::wire::server::Server::DoDeviceCreateShaderModule C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\src\dawn\wire\server\ServerDoers_autogen.cpp:328 #7 0x7ffd9dc73e24 in dawn::wire::server::Server::HandleDeviceCreateShaderModule C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\src\dawn\wire\server\ServerHandlers_autogen.cpp:643 #8 0x7ffd9dc78acb in dawn::wire::server::Server::HandleCommandsImpl C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\src\dawn\wire\server\ServerHandlers_autogen.cpp:1706 #9 0x7ffd9dc97412 in gpu::webgpu::anonymous namespace’::DawnWireServer::HandleCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:156 #10 0x7ffd9dc97865 in gpu::webgpu::anonymous namespace'::WebGPUDecoderImpl::HandleDawnCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1963 #11 0x7ffd9dc8d201 in gpu::webgpu::anonymous namespace’::WebGPUDecoderImpl::DoCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1908 #12 0x7ffd88c18213 in gpu::CommandBufferService::Flush C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\command_buffer_service.cc:266 #13 0x7ffd9dd269de in gpu::CommandBufferStub::OnAsyncFlush C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:495 #14 0x7ffd9dd258e5 in gpu::CommandBufferStub::ExecuteDeferredRequest C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:162 #15 0x7ffd9dcf0beb in gpu::GpuChannel::ExecuteDeferredRequest C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\gpu_channel.cc:848 #16 0x7ffd9dd00b83 in base::internal::Invoker<base::internal::FunctorTraits<void (GpuChannel::*&&)(mojo::StructPtrgpu::mojom::DeferredRequestParams, gpu::FenceSyncReleaseDelegate ),base::WeakPtrgpu::GpuChannel &&,mojo::StructPtrgpu::mojom::DeferredRequestParams &&>,base::internal::BindState<1,1,0,void (GpuChannel::)(mojo::StructPtr<gpu::mojom::DeferredRequestPara ms>, gpu::FenceSyncReleaseDelegate *),base::WeakPtrgpu::GpuChannel,mojo::StructPtrgpu::mojom::DeferredRequestParams >,void (gpu::FenceSyncReleaseDelegate *)>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973 #17 0x7ffd88c5839d in base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)> &&,gpu::FenceSyncReleaseDelegate *>,base::internal::BindState<0,1,1,base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>,base::internal::UnretainedWrappergpu::FenceSyncReleaseDelegate,base::unretained_traits::MayNotDangle,0 >,void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate )>,std::__Cr::tuple<base::internal::UnretainedWrappergpu::FenceSyncReleaseDelegate,base::unretained_traits::MayNotDangle,0 >,0> C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060 #18 0x7ffd88c2bfd0 in gpu::Scheduler::ExecuteSequence C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:672 #19 0x7ffd88c29c6d in gpu::Scheduler::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:594 #20 0x7ffd88c2f468 in base::internal::Invoker<base::internal::FunctorTraits<void (Scheduler::&&)(),gpu::Scheduler >,base::internal::BindState<1,1,0,void (Scheduler::)(),base::internal::UnretainedWrappergpu::Scheduler,base::unretained_traits::MayNotDangle,0 >,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973 #21 0x7ffd98e138c3 in base::TaskAnnotator::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207 #22 0x7ffd98de6a19 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:472 #23 0x7ffd98de58bf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:346 #24 0x7ffd98f48b32 in base::MessagePumpDefault::Run C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42 #25 0x7ffd98de8761 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:647 #26 0x7ffd98e8638e in base::RunLoop::Run C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134 #27 0x7ffda2326ab5 in content::GpuMain C:\b\s\w\ir\cache\builder\src\content\gpu\gpu_main.cc:474 #28 0x7ffd94f18a40 in content::RunOtherNamedProcessTypeMain C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:763 #29 0x7ffd94f1ae73 in content::ContentMainRunnerImpl::Run C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1129 #30 0x7ffd94f0f3cf in content::RunContentProcess C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:346 #31 0x7ffd94f0f95d in content::ContentMain C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:359 #32 0x7ffd85cd301f in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:228 #33 0x7ff76a84479b in MainDllLoader::Launch C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201 #34 0x7ff76a84200c in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352 #35 0x7ff76acffa2f in __scrt_common_main_seh D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #36 0x7ffeb034e8d6 in BaseThreadInitThunk+0x16 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6) #37 0x7ffeb1d5c34b in RtlUserThreadStart+0x2b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18003c34b) Address 0x1207e5f47bc0 is a wild pointer inside of access range of size 0x000000000008. SUMMARY: AddressSanitizer: heap-buffer-overflow C:\b\s\w\ir\cache\builder\src\third_party\abseil-cpp\absl\container\internal\raw_hash_set.h:2815 in absl::container_internal::raw_hash_set<absl::container_internal::FlatHashMapPolicy<unsigned int,dawn::native::ShaderBindingInfo>,absl::hash_internal::Hash<unsigned int>,std::__Cr::equal_to<unsigned int>,std::__Cr::allocator<std:: __Cr::pair<const unsigned int,dawn::native::ShaderBindingInfo> > >::find<unsigned int> Shadow bytes around the buggy address: 0x1207e5f47900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa =>0x1207e5f47b80: fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa 0x1207e5f47c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x1207e5f47c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==18232==ADDITIONAL INFO ==18232==Note: Please include this section with the ASan report. Task trace: #0 0x7ffd88c2a1fc in gpu::Scheduler::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:610 #1 0x7ffd88c2a1fc in gpu::Scheduler::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:610 #2 0x7ffd88c2a1fc in gpu::Scheduler::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:610 #3 0x7ffd88c2a1fc in gpu::Scheduler::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:610 Command line: "chromium-141.0.7379.0-win64-asan\chrome.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAMAAAwAAAAAAAAAAAAAAAAAAABIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1856,i,16049326817075466414,7205898037398527891,262144 - -field-trial-handle=1960,i,2671077517126853030,12550265571060057205,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,CookieIndicesHeader,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPolicyNegotiation,EnableCanvas2DLayer s,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PartitionedPopins,PrefetchCookieIndices,PrivateNetworkAccessRespectPreflightResults,ThirdPartyStoragePartitioning --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2 ==18232==END OF ADDITIONAL INFO ==18232==ABORTING

View on issue tracker

References

Vendor advisory Fix commit Bug tracker NVD

On This Page