Chrome · ANGLE
CVE-2026-14125
Uninitialized Memory in ANGLE
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
src/libANGLE/Context.cpp
Patch
From 9ce3268f4c4b0383b27ab28919e37ead03528c72 Mon Sep 17 00:00:00 2001 From: Shahbaz Youssefi <[email protected]> Date: Wed, 20 May 2026 16:36:42 -0400 Subject: [PATCH] Ensure maxColorAttachments == mDrawBufferStates in Caps In GLES, glDrawBuffers requires that draw buffers are mapped to either GL_NONE or the color attachment with the same index. ANGLE does not distinguish between draw buffer and color attachment indices in many places, so this change makes sure their limits are also identical. This is a theoretical fix for a driver where maxColorAttachments > maxDrawBuffers, which doesn't exist AFAICT. Bug: chromium:513918431 Change-Id: I70a3829360df27d88d69224d75219b9d604a792f Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7864741 Reviewed-by: Geoff Lang <[email protected]> Commit-Queue: Shahbaz Youssefi <[email protected]> --- diff --git a/src/libANGLE/Context.cpp b/src/libANGLE/Context.cpp index c3568e5..2b24785 100644 --- a/src/libANGLE/Context.cpp +++ b/src/libANGLE/Context.cpp @@ -4307,12 +4307,18 @@ } \ } while (0) - // Apply/Verify implementation limits - ANGLE_LIMIT_CAP(caps->maxDrawBuffers, IMPLEMENTATION_MAX_DRAW_BUFFERS); + // Apply/Verify implementation limits. + // + // GLES requires that draw buffers are mapped to color attachments with an identical index (in + // glDrawBuffers), and so draw buffers and color attachments are frequently interchanged in the + // codebase. The same limit is thus used for both. + const GLint maxDrawBuffersAndColorAttachments = std::min<GLint>( + std::min(caps->maxDrawBuffers, caps->maxColorAttachments), IMPLEMENTATION_MAX_DRAW_BUFFERS); + ANGLE_LIMIT_CAP(caps->maxDrawBuffers, maxDrawBuffersAndColorAttachments); ANGLE_LIMIT_CAP(caps->maxFramebufferWidth, IMPLEMENTATION_MAX_FRAMEBUFFER_SIZE); ANGLE_LIMIT_CAP(caps->maxFramebufferHeight, IMPLEMENTATION_MAX_FRAMEBUFFER_SIZE); ANGLE_LIMIT_CAP(caps->maxRenderbufferSize, IMPLEMENTATION_MAX_RENDERBUFFER_SIZE); - ANGLE_LIMIT_CAP(caps->maxColorAttachments, IMPLEMENTATION_MAX_DRAW_BUFFERS); + ANGLE_LIMIT_CAP(caps->maxColorAttachments, maxDrawBuffersAndColorAttachments); ANGLE_LIMIT_CAP(caps->maxVertexAttributes, MAX_VERTEX_ATTRIBS); if (mDisplay->getFrontendFeatures().forceMinimumMaxVertexAttributes.enabled && getClientVersion() <= Version(2, 0))
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page