Chrome · ANGLE
CVE-2026-14044
UAF in ANGLE
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
src/libGLESv2/egl_ext_stubs.cppsrc/libGLESv2/egl_stubs.cpp
Patch
From a17389c0182affe7dc3863efe0ff4aa0e48178e0 Mon Sep 17 00:00:00 2001 From: Shahbaz Youssefi <[email protected]> Date: Tue, 12 May 2026 15:23:44 -0400 Subject: [PATCH] Stop revalidating the sync object in ClientWaitSync The entry point already gets the sync object to operate on, so the error paths can directly use that instead of calling `GetSyncIfValid` to validate and get it again. This change also makes sure that a SyncID look up is not done in the unlocked tail of the call. Bug: chromium:497670996 Change-Id: If8a53f947a815acd51fb172f03ae5bdfc1dc8465 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7841557 Reviewed-by: Geoff Lang <[email protected]> Commit-Queue: Shahbaz Youssefi <[email protected]> --- diff --git a/src/libGLESv2/egl_ext_stubs.cpp b/src/libGLESv2/egl_ext_stubs.cpp index 1071199..91fb652 100644 --- a/src/libGLESv2/egl_ext_stubs.cpp +++ b/src/libGLESv2/egl_ext_stubs.cpp @@ -32,21 +32,20 @@ GetDisplayIfValid(display), EGL_FALSE); gl::Context *currentContext = thread->getContext(); EGLint syncStatus = EGL_FALSE; - Sync *sync = display->getSync(syncID); - ANGLE_EGL_TRY_RETURN(thread, - sync->clientWait(display, currentContext, flags, timeout, &syncStatus), - "eglClientWaitSyncKHR", GetSyncIfValid(display, syncID), EGL_FALSE); + Sync *syncObject = display->getSync(syncID); + ANGLE_EGL_TRY_RETURN( + thread, syncObject->clientWait(display, currentContext, flags, timeout, &syncStatus), + "eglClientWaitSyncKHR", syncObject, EGL_FALSE); // When performing CPU wait through UnlockedTailCall we need to handle any error conditions if (egl::Display::GetCurrentThreadUnlockedTailCall()->any()) { - auto handleErrorStatus = [thread, display, syncID](void *result) { + auto handleErrorStatus = [thread, syncObject](void *result) { EGLint *eglResult = static_cast<EGLint *>(result); ASSERT(eglResult); if (*eglResult == EGL_FALSE) { - thread->setError(egl::Error(EGL_BAD_ALLOC), "eglClientWaitSyncKHR", - GetSyncIfValid(display, syncID)); + thread->setError(egl::Error(EGL_BAD_ALLOC), "eglClientWaitSyncKHR", syncObject); } else { diff --git a/src/libGLESv2/egl_stubs.cpp b/src/libGLESv2/egl_stubs.cpp index 5b50837..d9db6c8 100644 --- a/src/libGLESv2/egl_stubs.cpp +++ b/src/libGLESv2/egl_stubs.cpp @@ -100,18 +100,17 @@ Sync *syncObject = display->getSync(syncID); ANGLE_EGL_TRY_RETURN( thread, syncObject->clientWait(display, currentContext, flags, timeout, &syncStatus), - "eglClientWaitSync", GetSyncIfValid(display, syncID), EGL_FALSE); + "eglClientWaitSync", syncObject, EGL_FALSE); // When performing CPU wait through UnlockedTailCall we need to handle any error conditions if (egl::Display::GetCurrentThreadUnlockedTailCall()->any()) { - auto handleErrorStatus = [thread, display, syncID](void *result) { + auto handleErrorStatus = [thread, syncObject](void *result) { EGLint *eglResult = static_cast<EGLint *>(result); ASSERT(eglResult); if (*eglResult == EGL_FALSE) { - thread->setError(egl::Error(EGL_BAD_ALLOC), "eglClientWaitSync", - GetSyncIfValid(display, syncID)); + thread->setError(egl::Error(EGL_BAD_ALLOC), "eglClientWaitSync", syncObject); } else {
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page