Chrome · Dawn
CVE-2026-17946
Uninitialized Memory in Dawn
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
src/dawn/wire/ChunkedCommandSerializer.h
Patch
From 11e4d46e28ba6123785e1809b26f66e37f9aa532 Mon Sep 17 00:00:00 2001 From: Kai Ninomiya <[email protected]> Date: Tue, 02 Jun 2026 17:21:47 -0700 Subject: [PATCH] [dawn][wire] Zero-init ChunkedCommandSerializer space Fixed: 515437522 Change-Id: Ia97bf8e68a7612428634c1187f67af96fa899ebf Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/312015 Auto-Submit: Kai Ninomiya <[email protected]> Reviewed-by: Loko Kung <[email protected]> Commit-Queue: Kai Ninomiya <[email protected]> --- diff --git a/src/dawn/wire/ChunkedCommandSerializer.h b/src/dawn/wire/ChunkedCommandSerializer.h index 67e4fc7..cac63cb 100644 --- a/src/dawn/wire/ChunkedCommandSerializer.h +++ b/src/dawn/wire/ChunkedCommandSerializer.h @@ -135,7 +135,9 @@ return; } - auto cmdSpace = std::unique_ptr<char[]>(new char[requiredSize]); + // Allocate as zero-initialized because padding won't get initialized during command + // serialization (and this whole buffer is sent raw to the other end of the wire). + auto cmdSpace = std::unique_ptr<char[]>(new char[requiredSize]{}); SerializeBuffer serializeBuffer(cmdSpace.get(), requiredSize); WireResult rCmd = SerializeCmd(cmd, requiredSize, &serializeBuffer);
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page