Chrome · Skia › SkSL
CVE-2026-119261
Input Validation in Skia (SkSL)
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- SkSL
- Skia’s shading language. Runtime effects (
SkRuntimeEffect, file extensions.rts/.rtcf/.rtsf) are SkSL programs supplied by the embedder (and, through CSS/Canvas filter and shader paths, ultimately influenced by web content) and compiled at runtime by Skia’s own SkSL compiler. - Private / reserved types
- Opaque GPU types such as
sampler2Dandtexture2Dare legal inside Skia’s internal modules but are not permitted in runtime effects. In the runtime-effect dialect they are aliased to the compiler’sfInvalidtype (seekPrivateTypesinSkSLModuleLoader.cpp), so that any attempt to name one is supposed to be rejected. - `fInvalid`
- A sentinel
Typeheld in the compiler’sContext(context.fTypes.fInvalid). Code throughout the compiler usesType::matches(fInvalid)to detect “this type is not usable.”
Root Cause Analysis
The invariant that was violated is “a reference to a private/reserved (hence fInvalid) type in a runtime effect must be rejected wherever it appears.” Before this patch, Parser::type() resolved a reserved type name to the fInvalid sentinel and returned it silently; the only place that turned an fInvalid base type into a reported error was VarDeclarationsParser/VarDeclaration::Convert in src/sksl/ir/SkSLVarDeclarations.cpp, which checked baseType->matches(*context.fTypes.fInvalid) and emitted "invalid type". That check only fires for top-level variable declarations. Any other syntactic position that calls Parser::type() but does not route through variable-declaration conversion — notably struct members (struct S { sampler2D x; };) and function parameters (half4 helper(sampler2D s, readonly texture2D t)) — accepted the fInvalid type without complaint, allowing a malformed type to be threaded into the IR (struct field types, parameter types) that the rest of the compiler assumes is well-formed. The new regression test InvalidTypeInStruct.rts and the expanded expectations in FunctionParametersOfTextureAndSamplerType.skrp (which now reports invalid type at each sampler2D/texture2D occurrence inside struct/param lists) are exactly those previously-unguarded positions.
The patch moves the validation up to the parser: in Parser::type(), immediately after type resolution, it adds if (result->matches(*fInvalid)) { this->error(type, "invalid type"); return result; }, so any use of the invalid/private type is rejected at parse time. The now-redundant error in SkSLVarDeclarations.cpp is demoted to a silent return false (the parser has already reported it), which avoids a duplicate “invalid type” diagnostic — visible in the updated Ossfuzz56373.glsl/.sksl expectations going from “2 errors” to “1 error”, while the struct/param cases newly produce the error. This is the advisory’s stated class — improper input validation — and the diff substantiates it directly. The specific memory-safety sink reached by an fInvalid-typed struct field or parameter is not shown by the diff (inferred); the fix is the completeness fix for the validation gap.
Key insight
The rejection of an invalid (private/reserved) type was attached to variable-declaration construction instead of to the one function every type reference passes through, so the same malformed type slipped past validation whenever it appeared as a struct member or function parameter.
Attack Path
- Reachability An attacker gets a crafted runtime-effect SkSL program to Skia’s compiler. Runtime effects are reachable from web content via Skia-backed filter/shader paths in the renderer/GPU process (inferred; the diff proves the parser gap, not the web entry point).
- Craft invalid-type use
Author a shader that names a reserved/private type (
sampler2D,texture2D) in a position other than a plain variable declaration — e.g. a struct fieldstruct S { sampler2D x; };or a function parameterhalf4 f(sampler2D s). - Bypass the only guard
Because
Parser::type()returnedfInvalidsilently and onlyVarDeclarationconversion rejected it, the invalid type is accepted for the struct/parameter and embedded into the compiler IR. - Downstream misuse
Later compilation stages operate on a struct/parameter carrying the
fInvalidtype they assume is well-formed, producing undefined behavior in the compiler (inferred: the exact corrupting operation is not in the diff). - Primitive Malformed-type-driven memory unsafety inside the SkSL compiler (strength not demonstrated by the diff; see Impact).
Impact Assessment
The flaw lives in Skia’s SkSL compiler, which in Chrome runs in the renderer or GPU process. Privilege required is the ability to submit a crafted runtime-effect shader, which is content-influenced (inferred web reachability). The proven effect of the diff is that an invalid/private type could reach the IR unvalidated through struct-member and function-parameter positions; the advisory rates this High and labels it improper input validation, consistent with the code. The concrete downstream primitive (the memory-safety sink an
fInvalid-typed field/param reaches) is not demonstrated by the diff and is therefore inferred; this writeup does not claim a specific read/write primitive or RCE. Gating: the input must be accepted far enough by the parser (the reserved type names are what trigger the bug), and the attacker needs a path that compiles attacker-controlled runtime effects.Files Changed
resources/sksl/errors/Ossfuzz56373.sksltests/sksl/intrinsics/Sample.skrptests/sksl/shared/ComplexDelete.skrptests/sksl/intrinsics/TextureReadSampler.skrptests/sksl/intrinsics/TextureReadImage.skrpsrc/sksl/ir/SkSLVarDeclarations.cpptests/sksl/shared/Texture2D.skrptests/sksl/intrinsics/SampleGrad.skrptests/sksl/shared/FunctionParametersOfTextureAndSamplerType.skrpgn/sksl_tests.gnitests/sksl/shared/RectangleTexture.skrpsrc/sksl/SkSLParser.cppresources/sksl/BUILD.bazeltests/sksl/errors/Ossfuzz56373.glslresources/sksl/runtime_errors/InvalidTypeInStruct.rtstests/sksl/intrinsics/TextureReadTexture.skrptests/sksl/shared/TextureSharpen.skrptests/sksl/intrinsics/TextureSizeSampler.skrptests/sksl/realistic/GaussianBlur.skrptests/sksl/intrinsics/TextureSizeImage.skrptests/sksl/intrinsics/SampleLod.skrptests/sksl/intrinsics/TextureSizeTexture.skrp
Audit Directions
- Other `Parser::type()` consumersAudit every grammar production that calls
type()without going through variable-declaration conversion (interface blocks, typedef-like aliases, cast/constructor contexts) to confirm the new parser-level check actually covers them and that none swallow the returnedfInvalidtype. - Other sentinel-type checksGrep for
matches(*...fInvalid)and similarly forisVoid()/error-type checks acrosssrc/sksl/ir/; wherever a check was placed at one IR-construction site rather than at the parser, the same “valid everywhere else” gap may exist. - Private-type list driftReview
kPrivateTypesinSkSLModuleLoader.cppagainst the runtime-effect dialect: any reserved type not aliased tofInvalidwould not be caught by this check at all. - Downstream assumptionsTrace struct-field and function-parameter type usage in later SkSL stages (inliner, codegen, SkRP/raster-pipeline backend) for code that dereferences or switches on a type without re-validating, to characterize the actual memory-safety sink this validation gap exposed.
Patch
From 0a8b2fc4864f895efd170fc81fe780a6c77d0b9d Mon Sep 17 00:00:00 2001 From: Nathan Sanchez <[email protected]> Date: Tue, 20 Oct 2026 14:50:22 -0400 Subject: [PATCH] [SkSL] Reject invalid types when parsing When parsing runtime effects, we alias private types to fInvalid to ensure they are not used or referenced as variable names. This ensures we emit errors for those types anywhere they are encountered, moving the check from variable declarations to the parser. Bug: 574213633 Change-Id: I6a27aead1ed83315e137752c5ef124e2f2020df4 Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1400318 Commit-Queue: Nathan Sanchez <[email protected]> Reviewed-by: Michael Ludwig <[email protected]> --- diff --git a/resources/sksl/errors/Ossfuzz56373.sksl b/resources/sksl/errors/Ossfuzz56373.sksl index f369f9d..276b355 100644 --- a/resources/sksl/errors/Ossfuzz56373.sksl +++ b/resources/sksl/errors/Ossfuzz56373.sksl @@ -4,5 +4,4 @@ /*%%* expected a type, found 'bufferThree' -invalid type *%%*/ diff --git a/resources/sksl/runtime_errors/InvalidTypeInStruct.rts b/resources/sksl/runtime_errors/InvalidTypeInStruct.rts new file mode 100644 index 0000000..5cae8b8 --- /dev/null +++ b/resources/sksl/runtime_errors/InvalidTypeInStruct.rts @@ -0,0 +1,11 @@ +// In runtime effects, private types like sampler2D are aliases of the invalid type. +// See kPrivateTypes in SkSLModuleLoader.cpp for the exhaustive list. +struct S { sampler2D x; }; +struct T { texture2D x; }; + +void main() {} + +/*%%* +invalid type +invalid type +*%%*/ diff --git a/src/sksl/SkSLParser.cpp b/src/sksl/SkSLParser.cpp index 49d801d..7860963 100644 --- a/src/sksl/SkSLParser.cpp +++ b/src/sksl/SkSLParser.cpp @@ -1292,6 +1292,12 @@ this->error(type, "expected a type, found '" + std::string(this->text(type)) + "'"); return fCompiler.context().fTypes.fInvalid.get(); } + if (result->matches(*fCompiler.context().fTypes.fInvalid)) { + // In runtime effects, reserved type names (e.g. sampler2D and texture2D) are aliases of the + // invalid type. Reject the type whenever it is used. + this->error(type, "invalid type"); + return result; + } Token bracket; while (this->checkNext(Token::Kind::TK_LBRACKET, &bracket)) { if (this->checkNext(Token::Kind::TK_RBRACKET)) { diff --git a/src/sksl/ir/SkSLVarDeclarations.cpp b/src/sksl/ir/SkSLVarDeclarations.cpp index 0d49ea3..8d83473 100644 --- a/src/sksl/ir/SkSLVarDeclarations.cpp +++ b/src/sksl/ir/SkSLVarDeclarations.cpp @@ -303,7 +303,8 @@ const Type* baseType, std::unique_ptr<Expression>& value) { if (baseType->matches(*context.fTypes.fInvalid)) { - context.fErrors->error(var.fPosition, "invalid type"); + // Parser::type() has already reported the error (e.g. a reserved type name like sampler2D + // in a runtime effect). Skip the declaration so it doesn't cause further errors. return false; } if (baseType->isVoid()) { diff --git a/tests/sksl/errors/Ossfuzz56373.glsl b/tests/sksl/errors/Ossfuzz56373.glsl index 7cd3cfc..6df13bf 100644 --- a/tests/sksl/errors/Ossfuzz56373.glsl +++ b/tests/sksl/errors/Ossfuzz56373.glsl @@ -3,7 +3,4 @@ error: 2: expected a type, found 'bufferThree' layout (binding=0) uniform bufferThree t; ^^^^^^^^^^^ -error: 2: invalid type -layout (binding=0) uniform bufferThree t; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -2 errors +1 error diff --git a/tests/sksl/intrinsics/Sample.skrp b/tests/sksl/intrinsics/Sample.skrp index 6628c2b..4d35940 100644 --- a/tests/sksl/intrinsics/Sample.skrp +++ b/tests/sksl/intrinsics/Sample.skrp @@ -2,7 +2,7 @@ error: 1: invalid type layout(binding=0) sampler2D t; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 2: 'main' must return: 'vec4', 'float4', or 'half4' void main() ^^^^^^^^^^^ diff --git a/tests/sksl/intrinsics/SampleGrad.skrp b/tests/sksl/intrinsics/SampleGrad.skrp index 760fabd..2151084 100644 --- a/tests/sksl/intrinsics/SampleGrad.skrp +++ b/tests/sksl/intrinsics/SampleGrad.skrp @@ -2,7 +2,7 @@ error: 1: invalid type layout(binding=0) sampler2D t; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 4: unknown identifier 'sampleGrad' return sampleGrad(t, coords, dFdx(coords), dFdy(coords)); ^^^^^^^^^^ diff --git a/tests/sksl/intrinsics/SampleLod.skrp b/tests/sksl/intrinsics/SampleLod.skrp index c48b3c1..80667ff 100644 --- a/tests/sksl/intrinsics/SampleLod.skrp +++ b/tests/sksl/intrinsics/SampleLod.skrp @@ -2,7 +2,7 @@ error: 1: invalid type layout(binding=0) sampler2D t; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 2: 'main' must return: 'vec4', 'float4', or 'half4' void main() ^^^^^^^^^^^ diff --git a/tests/sksl/intrinsics/TextureReadImage.skrp b/tests/sksl/intrinsics/TextureReadImage.skrp index c0a385e..6cc2bff 100644 --- a/tests/sksl/intrinsics/TextureReadImage.skrp +++ b/tests/sksl/intrinsics/TextureReadImage.skrp @@ -5,7 +5,7 @@ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ error: 2: invalid type layout(binding=0, rgba32f) readonly texture2D t; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 3: 'main' must return: 'vec4', 'float4', or 'half4' void main() ^^^^^^^^^^^ diff --git a/tests/sksl/intrinsics/TextureReadSampler.skrp b/tests/sksl/intrinsics/TextureReadSampler.skrp index f75811c..8116589 100644 --- a/tests/sksl/intrinsics/TextureReadSampler.skrp +++ b/tests/sksl/intrinsics/TextureReadSampler.skrp @@ -2,7 +2,7 @@ error: 1: invalid type layout(binding=0) sampler2D t; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 2: 'main' must return: 'vec4', 'float4', or 'half4' void main() ^^^^^^^^^^^ diff --git a/tests/sksl/intrinsics/TextureReadTexture.skrp b/tests/sksl/intrinsics/TextureReadTexture.skrp index a0a888d..6203864 100644 --- a/tests/sksl/intrinsics/TextureReadTexture.skrp +++ b/tests/sksl/intrinsics/TextureReadTexture.skrp @@ -5,7 +5,7 @@ ^^^^^^^^^^^^^^^^^^^^^^^^^^ error: 2: invalid type layout(binding=0) readonly texture2D t; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 3: 'main' must return: 'vec4', 'float4', or 'half4' void main() ^^^^^^^^^^^ diff --git a/tests/sksl/intrinsics/TextureSizeImage.skrp b/tests/sksl/intrinsics/TextureSizeImage.skrp index b99d235..2deb902 100644 --- a/tests/sksl/intrinsics/TextureSizeImage.skrp +++ b/tests/sksl/intrinsics/TextureSizeImage.skrp @@ -5,7 +5,7 @@ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ error: 1: invalid type layout(binding=0, rgba32f) readonly texture2D t; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 2: 'main' must return: 'vec4', 'float4', or 'half4' void main() ^^^^^^^^^^^ diff --git a/tests/sksl/intrinsics/TextureSizeSampler.skrp b/tests/sksl/intrinsics/TextureSizeSampler.skrp index 45b2d4e..641b2b7 100644 --- a/tests/sksl/intrinsics/TextureSizeSampler.skrp +++ b/tests/sksl/intrinsics/TextureSizeSampler.skrp @@ -2,7 +2,7 @@ error: 1: invalid type layout(binding=0) sampler2D t; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 2: 'main' must return: 'vec4', 'float4', or 'half4' void main() ^^^^^^^^^^^ diff --git a/tests/sksl/intrinsics/TextureSizeTexture.skrp b/tests/sksl/intrinsics/TextureSizeTexture.skrp index 3e1174a..638b224 100644 --- a/tests/sksl/intrinsics/TextureSizeTexture.skrp +++ b/tests/sksl/intrinsics/TextureSizeTexture.skrp @@ -5,7 +5,7 @@ ^^^^^^^^^^^^^^^^^^^^^^^^^^ error: 1: invalid type layout(binding=0) readonly texture2D t; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 2: 'main' must return: 'vec4', 'float4', or 'half4' void main() ^^^^^^^^^^^ diff --git a/tests/sksl/realistic/GaussianBlur.skrp b/tests/sksl/realistic/GaussianBlur.skrp index 99812c4..4832740 100644 --- a/tests/sksl/realistic/GaussianBlur.skrp +++ b/tests/sksl/realistic/GaussianBlur.skrp @@ -2,7 +2,7 @@ error: 1: invalid type layout(binding=0) sampler2D uTextureSampler_0_Stage1; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 2: interface blocks are not allowed in this kind of program layout (binding=0) uniform uniformBuffer ^^^^^^^^^^^^^ diff --git a/tests/sksl/shared/ComplexDelete.skrp b/tests/sksl/shared/ComplexDelete.skrp index 7fe6cdf..05d8bb4 100644 --- a/tests/sksl/shared/ComplexDelete.skrp +++ b/tests/sksl/shared/ComplexDelete.skrp @@ -2,7 +2,7 @@ error: 2: invalid type layout(binding=0) sampler2D s; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 4: 'main' must return: 'vec4', 'float4', or 'half4' void main() { ^^^^^^^^^^^ diff --git a/tests/sksl/shared/FunctionParametersOfTextureAndSamplerType.skrp b/tests/sksl/shared/FunctionParametersOfTextureAndSamplerType.skrp index cc67a0e..41682d1 100644 --- a/tests/sksl/shared/FunctionParametersOfTextureAndSamplerType.skrp +++ b/tests/sksl/shared/FunctionParametersOfTextureAndSamplerType.skrp @@ -5,28 +5,40 @@ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ error: 1: invalid type layout(set = 0, binding = 1) readonly texture2D aTexture; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 2: invalid type layout(set = 0, binding = 2) sampler2D aSampledTexture; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 3: invalid type layout(set = 0, binding = 3) sampler2D aSecondSampledTexture; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 5: 'in' is not permitted here layout(location = 1) in float2 c; ^^^^^^^^^^^^^^^^^^^^^^^ error: 5: layout qualifier 'location' is not permitted here layout(location = 1) in float2 c; ^^^^^^^^^^^^^^^^^^^^^^^ +error: 7: invalid type +noinline half4 helpers_helper(sampler2D s, readonly texture2D t) { + ^^^^^^^^^ error: 7: type 'texture2D' does not support qualifier 'readonly' noinline half4 helpers_helper(sampler2D s, readonly texture2D t) { ^^^^^^^^ +error: 7: invalid type +noinline half4 helpers_helper(sampler2D s, readonly texture2D t) { + ^^^^^^^^^ error: 8: unknown identifier 'sample' return sample(s, c); ^^^^^^ error: 11: type 'texture2D' does not support qualifier 'readonly' noinline half4 helper(readonly texture2D t, sampler2D s) { ^^^^^^^^ +error: 11: invalid type +noinline half4 helper(readonly texture2D t, sampler2D s) { + ^^^^^^^^^ +error: 11: invalid type +noinline half4 helper(readonly texture2D t, sampler2D s) { + ^^^^^^^^^ error: 15: 'main' must return: 'vec4', 'float4', or 'half4' void main() { ^^^^^^^^^^^ @@ -57,4 +69,4 @@ error: 18: unknown identifier 'aSampledTexture' sk_FragColor = helper(aTexture, aSampledTexture); ^^^^^^^^^^^^^^^ -19 errors +23 errors diff --git a/tests/sksl/shared/RectangleTexture.skrp b/tests/sksl/shared/RectangleTexture.skrp index a136e8e..85fe0af 100644 --- a/tests/sksl/shared/RectangleTexture.skrp +++ b/tests/sksl/shared/RectangleTexture.skrp @@ -2,10 +2,10 @@ error: 1: invalid type layout(binding=0) sampler2D test2D; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 2: invalid type layout(binding=1) sampler2D test2DRect; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 4: 'main' must return: 'vec4', 'float4', or 'half4' void main() { ^^^^^^^^^^^ diff --git a/tests/sksl/shared/Texture2D.skrp b/tests/sksl/shared/Texture2D.skrp index 1ffcee4..4d84c99 100644 --- a/tests/sksl/shared/Texture2D.skrp +++ b/tests/sksl/shared/Texture2D.skrp @@ -2,7 +2,7 @@ error: 1: invalid type layout(binding=0) sampler2D tex; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 3: 'main' must return: 'vec4', 'float4', or 'half4' void main() { ^^^^^^^^^^^ diff --git a/tests/sksl/shared/TextureSharpen.skrp b/tests/sksl/shared/TextureSharpen.skrp index 96938d4..df14f69 100644 --- a/tests/sksl/shared/TextureSharpen.skrp +++ b/tests/sksl/shared/TextureSharpen.skrp @@ -2,7 +2,7 @@ error: 3: invalid type layout(binding=0) sampler2D s; -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + ^^^^^^^^^ error: 5: 'main' must return: 'vec4', 'float4', or 'half4' void main() { ^^^^^^^^^^^ diff --git a/gn/sksl_tests.gni b/gn/sksl_tests.gni index 87ac2fc..574db2f 100644 --- a/gn/sksl_tests.gni +++ b/gn/sksl_tests.gni @@ -548,6 +548,7 @@ "runtime_errors/InvalidColorFilterFeatures.rtcf", "runtime_errors/InvalidColorFilterMain.rtcf", "runtime_errors/InvalidShaderMain.rts", + "runtime_errors/InvalidTypeInStruct.rts", "runtime_errors/InvalidUniformTypes.rts", "runtime_errors/InvalidUniformTypesES3.rts", "runtime_errors/LoopConditionErrors.rts", diff --git a/resources/sksl/BUILD.bazel b/resources/sksl/BUILD.bazel index 29a10d9..8618cf3 100644 --- a/resources/sksl/BUILD.bazel +++ b/resources/sksl/BUILD.bazel @@ -704,6 +704,7 @@ "runtime_errors/InvalidColorFilterFeatures.rtcf", "runtime_errors/InvalidColorFilterMain.rtcf", "runtime_errors/InvalidShaderMain.rts", + "runtime_errors/InvalidTypeInStruct.rts", "runtime_errors/InvalidUniformTypes.rts", "runtime_errors/InvalidUniformTypesES3.rts", "runtime_errors/LoopConditionErrors.rts",
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page