Chrome · ANGLE
CVE-2026-79043
OOB in ANGLE
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
src/libANGLE/renderer/vulkan/FramebufferVk.cppsrc/tests/angle_end2end_tests_expectations.txtsrc/tests/gl_tests/FramebufferTest.cpp
Patch
From 5bfb3c83c16f8e162ec9481228b2707f9980df08 Mon Sep 17 00:00:00 2001 From: Shahbaz Youssefi <[email protected]> Date: Fri, 17 Jul 2026 12:22:31 -0400 Subject: [PATCH] Vulkan: Fix blitting into 3D images Bug: chromium:532988552 Change-Id: I4c8717a84093e4d95651e6f5fde32e0424ef271b Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/8117567 Commit-Queue: Amirali Abdolrashidi <[email protected]> Reviewed-by: Charlie Lao <[email protected]> Reviewed-by: Amirali Abdolrashidi <[email protected]> --- diff --git a/src/libANGLE/renderer/vulkan/FramebufferVk.cpp b/src/libANGLE/renderer/vulkan/FramebufferVk.cpp index e05e633..301815a 100644 --- a/src/libANGLE/renderer/vulkan/FramebufferVk.cpp +++ b/src/libANGLE/renderer/vulkan/FramebufferVk.cpp @@ -2202,7 +2202,6 @@ resolveRegion.dstSubresource.layerCount = 1; resolveRegion.dstOffset.x = params.blitArea.x; resolveRegion.dstOffset.y = params.blitArea.y; - resolveRegion.dstOffset.z = 0; resolveRegion.extent.width = params.blitArea.width; resolveRegion.extent.height = params.blitArea.height; resolveRegion.extent.depth = 1; @@ -2213,9 +2212,15 @@ RenderTargetVk *drawRenderTarget = mRenderTargetCache.getColors()[colorIndexGL]; vk::ImageHelper &dstImage = drawRenderTarget->getImageForWrite(); + // Note: In GL, the src image cannot be 3D because there is no way to create a multisampled + // 3D texture. + const bool isDst3D = dstImage.getType() == VK_IMAGE_TYPE_3D; + vk::LevelIndex levelVk = dstImage.toVkLevel(drawRenderTarget->getLevelIndex()); resolveRegion.dstSubresource.mipLevel = levelVk.get(); - resolveRegion.dstSubresource.baseArrayLayer = drawRenderTarget->getLayerIndex(); + resolveRegion.dstSubresource.baseArrayLayer = + isDst3D ? 0 : drawRenderTarget->getLayerIndex(); + resolveRegion.dstOffset.z = isDst3D ? drawRenderTarget->getLayerIndex() : 0; srcImage->resolve(renderer, &dstImage, resolveRegion, commandBuffer); diff --git a/src/tests/angle_end2end_tests_expectations.txt b/src/tests/angle_end2end_tests_expectations.txt index 8e8ab37..094c485 100644 --- a/src/tests/angle_end2end_tests_expectations.txt +++ b/src/tests/angle_end2end_tests_expectations.txt @@ -337,8 +337,10 @@ 491363839 NVIDIA VULKAN : GLSLTest_ES31.HelperInvocationsAfterDiscard/* = SKIP // Test cannot run when ASTC is emulated 525079760 NVIDIA VULKAN : ImageTestES3.NonZeroLevel*GetCompressedTexImage/* = SKIP - -// Nvidia Vulkan +536046166 NVIDIA VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitIntoMixedTextures/* = SKIP +536046166 NVIDIA VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitIntoMixedTexturesAfterFinish/* = SKIP +536046166 NVIDIA VULKAN : FramebufferTest_ES31_MSAA.MultisampleResolveWithBlitIntoMixedTextures/* = SKIP +536046166 NVIDIA VULKAN : FramebufferTest_ES31_MSAA.MultisampleStencilSampling/*EmulatedPrerotation* = SKIP 42265709 NVIDIA VULKAN : GLSLTest_ES31.TessellationControlShaderMatrixCopyBug/* = SKIP 42265709 NVIDIA VULKAN : GLSLTest_ES31.TessellationControlShaderMatrixMultiplicationBug/* = SKIP @@ -381,6 +383,10 @@ 40096893 LINUX INTEL VULKAN : TextureBufferTestES31.TexBufferFormatMismatch/* = SKIP // RobustBufferAccess is not actually robust (will hang). 435228814 LINUX INTEL VULKAN : RobustBufferAccessBehaviorTest.DynamicBufferCrash/* = SKIP +536046166 INTEL VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitIntoMixedTextures/* = SKIP +536046166 INTEL VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitIntoMixedTexturesAfterFinish/* = SKIP +536046166 INTEL VULKAN : FramebufferTest_ES31_MSAA.MultisampleResolveWithBlitIntoMixedTextures/* = SKIP +536046166 WIN INTEL VULKAN : FramebufferTest_ES31_MSAA.MultisampleStencilSampling/*EmulatedPrerotation* = SKIP // Robust init of OOB framebuffer reads is not zero'd 500528706 VULKAN : CopyTexImageTestRobustResourceInit.OOBReadShouldBeZeroInit/* = SKIP @@ -673,6 +679,11 @@ 384314370 PIXEL4ORXL GLES : FramebufferFetchES31.WriteOnlyInOutVariableEarlyReturn/* = SKIP 384314370 PIXEL4ORXL GLES : FramebufferFetchES31.WriteOnlyInOutVariablePartial/* = SKIP 384314370 PIXEL4ORXL GLES : FramebufferFetchES31.WriteOnlyInOutVariableInOutArgument/* = SKIP +536042538 PIXEL4ORXL GLES : FramebufferTest_ES31.MultisampleResolveWithBlitInto3DTexture/* = SKIP +536042538 PIXEL4ORXL GLES : FramebufferTest_ES31.MultisampleResolveWithBlitIntoMixedTextures/* = SKIP +536042538 PIXEL4ORXL GLES : FramebufferTest_ES31.MultisampleResolveWithBlitIntoMixedTexturesAfterFinish/* = SKIP +536042538 PIXEL4ORXL GLES : FramebufferTest_ES31_MSAA.MultisampleResolveWithBlitInto3DTexture/* = SKIP +536042538 PIXEL4ORXL GLES : FramebufferTest_ES31_MSAA.MultisampleResolveWithBlitIntoMixedTextures/* = SKIP 42264513 PIXEL4ORXL GLES : GLSLTest.NestedInoutVars2/* = SKIP 42264513 PIXEL4ORXL GLES : GLSLTest.NestedInoutVars3/* = SKIP 42264513 PIXEL4ORXL GLES : SimpleUniformTestES3.TernarySelectAnArrayThenIndex/* = SKIP @@ -756,6 +767,7 @@ 40096826 PIXEL6 VULKAN : FramebufferMultiviewLayeredClearTest.ScissoredClearBufferfi/* = SKIP 40096826 PIXEL6 VULKAN : FramebufferTest_ES31.MultipleTextureMultisampleResolveWithBlitMultipleResolves* = SKIP 40096826 PIXEL6 VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitThenDrawAttachment1/* = SKIP +536046166 PIXEL6 VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitInto3DTexture/* = SKIP 40096826 PIXEL6 VULKAN : GLSLTest.PointCoordConsistency/* = SKIP 40096826 PIXEL6 VULKAN : GLSLTest_ES31.ArraysOfArraysImage/* = SKIP 40096826 PIXEL6 VULKAN : GLSLTest_ES31.BoolInInterfaceBlocks/* = SKIP @@ -954,6 +966,7 @@ 480069042 PIXEL10 GLES : FramebufferTest_ES31.DepthStencilResolveThenDrawWithoutResolve/* = SKIP 480069042 PIXEL10 GLES : FramebufferTest_ES31.MixesMultisampleTextureRenderbuffer/* = SKIP 480069042 PIXEL10 GLES : FramebufferTest_ES31.MultisampleDepthStencilResolveMultipleTimesWithDrawInBetween/* = SKIP +536042538 PIXEL10 GLES : FramebufferTest_ES31.MultisampleResolveWithBlitInto3DTexture/* = SKIP 379700129 PIXEL10 GLES : FramebufferTest_ES31_MSAA.MultisampleStencilSampling/* = SKIP 480069042 PIXEL10 GLES : GLSLConstantFoldingTest_ES31.NamedArrayOfArrayIndex/* = SKIP 480069042 PIXEL10 GLES : GLSLTest.NestedStructsWithSamplersAsFunctionArg/* = SKIP @@ -1255,6 +1268,7 @@ 480069042 PIXEL10 VULKAN : ExternalBufferTestES31.SubDataDoesNotCauseOrphaning/* = SKIP 480069042 PIXEL10 VULKAN : ExternalBufferTestES31.getBufferParameter/* = SKIP 480069042 PIXEL10 VULKAN : FramebufferTest_ES31.DepthStencilResolveThenDrawWithoutResolve/* = SKIP +536046166 PIXEL10 VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitInto3DTexture/* = SKIP 480069042 PIXEL10 VULKAN : GLSLTest_ES31.ArrayOfArrayOfSamplerDynamicIndexEXT/* = SKIP 480069042 PIXEL10 VULKAN : GLSLTest_ES31.ArrayOfArrayOfSamplerDynamicIndexOES/* = SKIP 480069042 PIXEL10 VULKAN : GLSLTest_ES31.ArrayOfArrayOfSamplerInStructDynamicIndex/* = SKIP diff --git a/src/tests/gl_tests/FramebufferTest.cpp b/src/tests/gl_tests/FramebufferTest.cpp index 56c8318..542da6e 100644 --- a/src/tests/gl_tests/FramebufferTest.cpp +++ b/src/tests/gl_tests/FramebufferTest.cpp @@ -3488,7 +3488,7 @@ // Test resolving a multisampled texture with blit TEST_P(FramebufferTest_ES31, MultisampleResolveWithBlit) { - constexpr int kSize = 16; + constexpr uint32_t kSize = 16; glViewport(0, 0, kSize, kSize); GLFramebuffer msaaFBO; @@ -3530,6 +3530,274 @@ 255, 1.0); } +// Test resolving a multisampled texture with blit into a 3D texture. +TEST_P(FramebufferTest_ES31, MultisampleResolveWithBlitInto3DTexture) +{ + constexpr uint32_t kSize = 16; + constexpr uint32_t kBlitSlice = 11; + glViewport(0, 0, kSize, kSize); + + GLFramebuffer msaaFBO; + glBindFramebuffer(GL_FRAMEBUFFER, msaaFBO); + + GLTexture texture; + glBindTexture(GL_TEXTURE_2D_MULTISAMPLE, texture); + glTexStorage2DMultisample(GL_TEXTURE_2D_MULTISAMPLE, 4, GL_RGBA8, kSize, kSize, false); + ASSERT_GL_NO_ERROR(); + glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D_MULTISAMPLE, texture, + 0); + ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER); + + ANGLE_GL_PROGRAM(gradientProgram, essl31_shaders::vs::Passthrough(), + essl31_shaders::fs::RedGreenGradient()); + drawQuad(gradientProgram, essl31_shaders::PositionAttrib(), 0.5f, 1.0f, true); + ASSERT_GL_NO_ERROR(); + + // Create another FBO to resolve the multisample buffer into. Use a 3D texture. + GLTexture resolveTexture; + GLFramebuffer resolveFBO; + glBindTexture(GL_TEXTURE_3D, resolveTexture); + glTexImage3D(GL_TEXTURE_3D, 0, GL_RGBA, kSize, kSize, kSize, 0, GL_RGBA, GL_UNSIGNED_BYTE, + nullptr); + glBindFramebuffer(GL_FRAMEBUFFER, resolveFBO); + glFramebufferTextureLayer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, resolveTexture, 0, kBlitSlice); + ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER); + + glBindFramebuffer(GL_READ_FRAMEBUFFER, msaaFBO); + glBindFramebuffer(GL_DRAW_FRAMEBUFFER, resolveFBO); + glBlitFramebuffer(0, 0, kSize, kSize, 0, 0, kSize, kSize, GL_COLOR_BUFFER_BIT, GL_NEAREST); + ASSERT_GL_NO_ERROR(); + + glBindFramebuffer(GL_READ_FRAMEBUFFER, resolveFBO); + constexpr uint8_t kHalfPixelGradient = 256 / kSize / 2; + EXPECT_PIXEL_NEAR(0, 0, kHalfPixelGradient, kHalfPixelGradient, 0, 255, 1.0); + EXPECT_PIXEL_NEAR(kSize - 1, 0, 255 - kHalfPixelGradient, kHalfPixelGradient, 0, 255, 1.0); + EXPECT_PIXEL_NEAR(0, kSize - 1, kHalfPixelGradient, 255 - kHalfPixelGradient, 0, 255, 1.0); + EXPECT_PIXEL_NEAR(kSize - 1, kSize - 1, 255 - kHalfPixelGradient, 255 - kHalfPixelGradient, 0, + 255, 1.0); +} + +// Test resolving a multisampled texture with blit into multiple textures, including 3D textures. +TEST_P(FramebufferTest_ES31, MultisampleResolveWithBlitIntoMixedTextures) +{ + constexpr uint32_t kSize = 16; + constexpr uint32_t kBlitSlice = 11; + glViewport(0, 0, kSize, kSize); + + GLFramebuffer msaaFBO; + glBindFramebuffer(GL_FRAMEBUFFER, msaaFBO); + + GLTexture texture; + glBindTexture(GL_TEXTURE_2D_MULTISAMPLE, texture); + glTexStorage2DMultisample(GL_TEXTURE_2D_MULTISAMPLE, 4, GL_RGBA8, kSize, kSize, false); + ASSERT_GL_NO_ERROR(); + glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D_MULTISAMPLE, texture, + 0); + ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER); + + ANGLE_GL_PROGRAM(gradientProgram, essl31_shaders::vs::Passthrough(), + essl31_shaders::fs::RedGreenGradient()); + drawQuad(gradientProgram, essl31_shaders::PositionAttrib(), 0.5f, 1.0f, true); + ASSERT_GL_NO_ERROR(); + + // Create another FBO to resolve the multisample buffer into. Use a 3D texture for some + // attachments. + GLFramebuffer resolveFBO; + glBindFramebuffer(GL_FRAMEBUFFER, resolveFBO); + std::array<GLTexture, 4> resolveTexture; + for (size_t i = 0; i < resolveTexture.size(); ++i) + {
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/src/tests/angle_end2end_tests_expectations.txt b/src/tests/angle_end2end_tests_expectations.txt
index 8e8ab37..094c485 100644
--- a/src/tests/angle_end2end_tests_expectations.txt
+++ b/src/tests/angle_end2end_tests_expectations.txt
@@ -337,8 +337,10 @@
491363839 NVIDIA VULKAN : GLSLTest_ES31.HelperInvocationsAfterDiscard/* = SKIP
// Test cannot run when ASTC is emulated
525079760 NVIDIA VULKAN : ImageTestES3.NonZeroLevel*GetCompressedTexImage/* = SKIP
-
-// Nvidia Vulkan
+536046166 NVIDIA VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitIntoMixedTextures/* = SKIP
+536046166 NVIDIA VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitIntoMixedTexturesAfterFinish/* = SKIP
+536046166 NVIDIA VULKAN : FramebufferTest_ES31_MSAA.MultisampleResolveWithBlitIntoMixedTextures/* = SKIP
+536046166 NVIDIA VULKAN : FramebufferTest_ES31_MSAA.MultisampleStencilSampling/*EmulatedPrerotation* = SKIP
42265709 NVIDIA VULKAN : GLSLTest_ES31.TessellationControlShaderMatrixCopyBug/* = SKIP
42265709 NVIDIA VULKAN : GLSLTest_ES31.TessellationControlShaderMatrixMultiplicationBug/* = SKIP
@@ -381,6 +383,10 @@
40096893 LINUX INTEL VULKAN : TextureBufferTestES31.TexBufferFormatMismatch/* = SKIP
// RobustBufferAccess is not actually robust (will hang).
435228814 LINUX INTEL VULKAN : RobustBufferAccessBehaviorTest.DynamicBufferCrash/* = SKIP
+536046166 INTEL VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitIntoMixedTextures/* = SKIP
+536046166 INTEL VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitIntoMixedTexturesAfterFinish/* = SKIP
+536046166 INTEL VULKAN : FramebufferTest_ES31_MSAA.MultisampleResolveWithBlitIntoMixedTextures/* = SKIP
+536046166 WIN INTEL VULKAN : FramebufferTest_ES31_MSAA.MultisampleStencilSampling/*EmulatedPrerotation* = SKIP
// Robust init of OOB framebuffer reads is not zero'd
500528706 VULKAN : CopyTexImageTestRobustResourceInit.OOBReadShouldBeZeroInit/* = SKIP
@@ -673,6 +679,11 @@
384314370 PIXEL4ORXL GLES : FramebufferFetchES31.WriteOnlyInOutVariableEarlyReturn/* = SKIP
384314370 PIXEL4ORXL GLES : FramebufferFetchES31.WriteOnlyInOutVariablePartial/* = SKIP
384314370 PIXEL4ORXL GLES : FramebufferFetchES31.WriteOnlyInOutVariableInOutArgument/* = SKIP
+536042538 PIXEL4ORXL GLES : FramebufferTest_ES31.MultisampleResolveWithBlitInto3DTexture/* = SKIP
+536042538 PIXEL4ORXL GLES : FramebufferTest_ES31.MultisampleResolveWithBlitIntoMixedTextures/* = SKIP
+536042538 PIXEL4ORXL GLES : FramebufferTest_ES31.MultisampleResolveWithBlitIntoMixedTexturesAfterFinish/* = SKIP
+536042538 PIXEL4ORXL GLES : FramebufferTest_ES31_MSAA.MultisampleResolveWithBlitInto3DTexture/* = SKIP
+536042538 PIXEL4ORXL GLES : FramebufferTest_ES31_MSAA.MultisampleResolveWithBlitIntoMixedTextures/* = SKIP
42264513 PIXEL4ORXL GLES : GLSLTest.NestedInoutVars2/* = SKIP
42264513 PIXEL4ORXL GLES : GLSLTest.NestedInoutVars3/* = SKIP
42264513 PIXEL4ORXL GLES : SimpleUniformTestES3.TernarySelectAnArrayThenIndex/* = SKIP
@@ -756,6 +767,7 @@
40096826 PIXEL6 VULKAN : FramebufferMultiviewLayeredClearTest.ScissoredClearBufferfi/* = SKIP
40096826 PIXEL6 VULKAN : FramebufferTest_ES31.MultipleTextureMultisampleResolveWithBlitMultipleResolves* = SKIP
40096826 PIXEL6 VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitThenDrawAttachment1/* = SKIP
+536046166 PIXEL6 VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitInto3DTexture/* = SKIP
40096826 PIXEL6 VULKAN : GLSLTest.PointCoordConsistency/* = SKIP
40096826 PIXEL6 VULKAN : GLSLTest_ES31.ArraysOfArraysImage/* = SKIP
40096826 PIXEL6 VULKAN : GLSLTest_ES31.BoolInInterfaceBlocks/* = SKIP
@@ -954,6 +966,7 @@
480069042 PIXEL10 GLES : FramebufferTest_ES31.DepthStencilResolveThenDrawWithoutResolve/* = SKIP
480069042 PIXEL10 GLES : FramebufferTest_ES31.MixesMultisampleTextureRenderbuffer/* = SKIP
480069042 PIXEL10 GLES : FramebufferTest_ES31.MultisampleDepthStencilResolveMultipleTimesWithDrawInBetween/* = SKIP
+536042538 PIXEL10 GLES : FramebufferTest_ES31.MultisampleResolveWithBlitInto3DTexture/* = SKIP
379700129 PIXEL10 GLES : FramebufferTest_ES31_MSAA.MultisampleStencilSampling/* = SKIP
480069042 PIXEL10 GLES : GLSLConstantFoldingTest_ES31.NamedArrayOfArrayIndex/* = SKIP
480069042 PIXEL10 GLES : GLSLTest.NestedStructsWithSamplersAsFunctionArg/* = SKIP
@@ -1255,6 +1268,7 @@
480069042 PIXEL10 VULKAN : ExternalBufferTestES31.SubDataDoesNotCauseOrphaning/* = SKIP
480069042 PIXEL10 VULKAN : ExternalBufferTestES31.getBufferParameter/* = SKIP
480069042 PIXEL10 VULKAN : FramebufferTest_ES31.DepthStencilResolveThenDrawWithoutResolve/* = SKIP
+536046166 PIXEL10 VULKAN : FramebufferTest_ES31.MultisampleResolveWithBlitInto3DTexture/* = SKIP
480069042 PIXEL10 VULKAN : GLSLTest_ES31.ArrayOfArrayOfSamplerDynamicIndexEXT/* = SKIP
480069042 PIXEL10 VULKAN : GLSLTest_ES31.ArrayOfArrayOfSamplerDynamicIndexOES/* = SKIP
480069042 PIXEL10 VULKAN : GLSLTest_ES31.ArrayOfArrayOfSamplerInStructDynamicIndex/* = SKIP
diff --git a/src/tests/gl_tests/FramebufferTest.cpp b/src/tests/gl_tests/FramebufferTest.cpp
index 56c8318..542da6e 100644
--- a/src/tests/gl_tests/FramebufferTest.cpp
+++ b/src/tests/gl_tests/FramebufferTest.cpp
@@ -3488,7 +3488,7 @@
// Test resolving a multisampled texture with blit
TEST_P(FramebufferTest_ES31, MultisampleResolveWithBlit)
{
- constexpr int kSize = 16;
+ constexpr uint32_t kSize = 16;
glViewport(0, 0, kSize, kSize);
GLFramebuffer msaaFBO;
@@ -3530,6 +3530,274 @@
255, 1.0);
}
+// Test resolving a multisampled texture with blit into a 3D texture.
+TEST_P(FramebufferTest_ES31, MultisampleResolveWithBlitInto3DTexture)
+{
+ constexpr uint32_t kSize = 16;
+ constexpr uint32_t kBlitSlice = 11;
+ glViewport(0, 0, kSize, kSize);
+
+ GLFramebuffer msaaFBO;
+ glBindFramebuffer(GL_FRAMEBUFFER, msaaFBO);
+
+ GLTexture texture;
+ glBindTexture(GL_TEXTURE_2D_MULTISAMPLE, texture);
+ glTexStorage2DMultisample(GL_TEXTURE_2D_MULTISAMPLE, 4, GL_RGBA8, kSize, kSize, false);
+ ASSERT_GL_NO_ERROR();
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D_MULTISAMPLE, texture,
+ 0);
+ ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER);
+
+ ANGLE_GL_PROGRAM(gradientProgram, essl31_shaders::vs::Passthrough(),
+ essl31_shaders::fs::RedGreenGradient());
+ drawQuad(gradientProgram, essl31_shaders::PositionAttrib(), 0.5f, 1.0f, true);
+ ASSERT_GL_NO_ERROR();
+
+ // Create another FBO to resolve the multisample buffer into. Use a 3D texture.
+ GLTexture resolveTexture;
+ GLFramebuffer resolveFBO;
+ glBindTexture(GL_TEXTURE_3D, resolveTexture);
+ glTexImage3D(GL_TEXTURE_3D, 0, GL_RGBA, kSize, kSize, kSize, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ nullptr);
+ glBindFramebuffer(GL_FRAMEBUFFER, resolveFBO);
+ glFramebufferTextureLayer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, resolveTexture, 0, kBlitSlice);
+ ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER);
+
+ glBindFramebuffer(GL_READ_FRAMEBUFFER, msaaFBO);
+ glBindFramebuffer(GL_DRAW_FRAMEBUFFER, resolveFBO);
+ glBlitFramebuffer(0, 0, kSize, kSize, 0, 0, kSize, kSize, GL_COLOR_BUFFER_BIT, GL_NEAREST);
+ ASSERT_GL_NO_ERROR();
+
+ glBindFramebuffer(GL_READ_FRAMEBUFFER, resolveFBO);
+ constexpr uint8_t kHalfPixelGradient = 256 / kSize / 2;
+ EXPECT_PIXEL_NEAR(0, 0, kHalfPixelGradient, kHalfPixelGradient, 0, 255, 1.0);
+ EXPECT_PIXEL_NEAR(kSize - 1, 0, 255 - kHalfPixelGradient, kHalfPixelGradient, 0, 255, 1.0);
+ EXPECT_PIXEL_NEAR(0, kSize - 1, kHalfPixelGradient, 255 - kHalfPixelGradient, 0, 255, 1.0);
+ EXPECT_PIXEL_NEAR(kSize - 1, kSize - 1, 255 - kHalfPixelGradient, 255 - kHalfPixelGradient, 0,
+ 255, 1.0);
+}
+
+// Test resolving a multisampled texture with blit into multiple textures, including 3D textures.
+TEST_P(FramebufferTest_ES31, MultisampleResolveWithBlitIntoMixedTextures)
+{
+ constexpr uint32_t kSize = 16;
+ constexpr uint32_t kBlitSlice = 11;
+ glViewport(0, 0, kSize, kSize);
+
+ GLFramebuffer msaaFBO;
+ glBindFramebuffer(GL_FRAMEBUFFER, msaaFBO);
+
+ GLTexture texture;
+ glBindTexture(GL_TEXTURE_2D_MULTISAMPLE, texture);
+ glTexStorage2DMultisample(GL_TEXTURE_2D_MULTISAMPLE, 4, GL_RGBA8, kSize, kSize, false);
+ ASSERT_GL_NO_ERROR();
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D_MULTISAMPLE, texture,
+ 0);
+ ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER);
+
+ ANGLE_GL_PROGRAM(gradientProgram, essl31_shaders::vs::Passthrough(),
+ essl31_shaders::fs::RedGreenGradient());
+ drawQuad(gradientProgram, essl31_shaders::PositionAttrib(), 0.5f, 1.0f, true);
+ ASSERT_GL_NO_ERROR();
+
+ // Create another FBO to resolve the multisample buffer into. Use a 3D texture for some
+ // attachments.
+ GLFramebuffer resolveFBO;
+ glBindFramebuffer(GL_FRAMEBUFFER, resolveFBO);
+ std::array<GLTexture, 4> resolveTexture;
+ for (size_t i = 0; i < resolveTexture.size(); ++i)
+ {
+ if (i % 2 == 0)
+ {
+ glBindTexture(GL_TEXTURE_3D, resolveTexture[i]);
+ glTexImage3D(GL_TEXTURE_3D, 0, GL_RGBA, kSize, kSize, kSize, 0, GL_RGBA,
+ GL_UNSIGNED_BYTE, nullptr);
+ glFramebufferTextureLayer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0 + i, resolveTexture[i],
+ 0, kBlitSlice);
+ }
+ else
+ {
+ glBindTexture(GL_TEXTURE_2D, resolveTexture[i]);
+ glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kSize, kSize, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ nullptr);
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0 + i, GL_TEXTURE_2D,
+ resolveTexture[i], 0);
+ }
+ }
+ constexpr std::array<GLenum, 4> kDrawBuffers = {GL_COLOR_ATTACHMENT0, GL_COLOR_ATTACHMENT1,
+ GL_COLOR_ATTACHMENT2, GL_COLOR_ATTACHMENT3};
+ glDrawBuffers(4, kDrawBuffers.data());
+ ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER);
+
+ glBindFramebuffer(GL_READ_FRAMEBUFFER, msaaFBO);
+ glBindFramebuffer(GL_DRAW_FRAMEBUFFER, resolveFBO);
+ glBlitFramebuffer(0, 0, kSize, kSize, 0, 0, kSize, kSize, GL_COLOR_BUFFER_BIT, GL_NEAREST);
+ ASSERT_GL_NO_ERROR();
+
+ glBindFramebuffer(GL_READ_FRAMEBUFFER, resolveFBO);
+ constexpr uint8_t kHalfPixelGradient = 256 / kSize / 2;
+ for (size_t i = 0; i < resolveTexture.size(); ++i)
+ {
+ glReadBuffer(GL_COLOR_ATTACHMENT0 + i);
+ EXPECT_PIXEL_NEAR(0, 0, kHalfPixelGradient, kHalfPixelGradient, 0, 255, 1.0);
+ EXPECT_PIXEL_NEAR(kSize - 1, 0, 255 - kHalfPixelGradient, kHalfPixelGradient, 0, 255, 1.0);
+ EXPECT_PIXEL_NEAR(0, kSize - 1, kHalfPixelGradient, 255 - kHalfPixelGradient, 0, 255, 1.0);
+ EXPECT_PIXEL_NEAR(kSize - 1, kSize - 1, 255 - kHalfPixelGradient, 255 - kHalfPixelGradient,
+ 0, 255, 1.0);
+ }
+}
+
+// Test resolving a multisampled texture with blit into multiple textures, including 3D textures,
+// after the render pass is closed.
+TEST_P(FramebufferTest_ES31, MultisampleResolveWithBlitIntoMixedTexturesAfterFinish)
+{
+ constexpr uint32_t kSize = 16;
+ constexpr uint32_t kBlitSlice = 11;
+ glViewport(0, 0, kSize, kSize);
+
+ GLFramebuffer msaaFBO;
+ glBindFramebuffer(GL_FRAMEBUFFER, msaaFBO);
+
+ GLTexture texture;
+ glBindTexture(GL_TEXTURE_2D_MULTISAMPLE, texture);
+ glTexStorage2DMultisample(GL_TEXTURE_2D_MULTISAMPLE, 4, GL_RGBA8, kSize, kSize, false);
+ ASSERT_GL_NO_ERROR();
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D_MULTISAMPLE, texture,
+ 0);
+ ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER);
+
+ ANGLE_GL_PROGRAM(gradientProgram, essl31_shaders::vs::Passthrough(),
+ essl31_shaders::fs::RedGreenGradient());
+ drawQuad(gradientProgram, essl31_shaders::PositionAttrib(), 0.5f, 1.0f, true);
+ ASSERT_GL_NO_ERROR();
+
+ // Close the render pass. In the Vulkan backend, this disallows directly resolving into the
+ // destination with a render pass resolve attachment.
+ glFinish();
+
+ // Create another FBO to resolve the multisample buffer into. Use a 3D texture for some
+ // attachments.
+ GLFramebuffer resolveFBO;
+ glBindFramebuffer(GL_FRAMEBUFFER, resolveFBO);
+ std::array<GLTexture, 4> resolveTexture;
+ for (size_t i = 0; i < resolveTexture.size(); ++i)
+ {
+ if (i % 2 == 1)
+ {
+ glBindTexture(GL_TEXTURE_3D, resolveTexture[i]);
+ glTexImage3D(GL_TEXTURE_3D, 0, GL_RGBA, kSize, kSize, kSize, 0, GL_RGBA,
+ GL_UNSIGNED_BYTE, nullptr);
+ glFramebufferTextureLayer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0 + i, resolveTexture[i],
+ 0, kBlitSlice);
+ }
+ else
+ {
+ glBindTexture(GL_TEXTURE_2D, resolveTexture[i]);
+ glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kSize, kSize, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ nullptr);
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0 + i, GL_TEXTURE_2D,
+ resolveTexture[i], 0);
+ }
+ }
+ constexpr std::array<GLenum, 4> kDrawBuffers = {GL_COLOR_ATTACHMENT0, GL_COLOR_ATTACHMENT1,
+ GL_COLOR_ATTACHMENT2, GL_COLOR_ATTACHMENT3};
+ glDrawBuffers(4, kDrawBuffers.data());
+ ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER);
+
+ glBindFramebuffer(GL_READ_FRAMEBUFFER, msaaFBO);
+ glBindFramebuffer(GL_DRAW_FRAMEBUFFER, resolveFBO);
+ glBlitFramebuffer(0, 0, kSize, kSize, 0, 0, kSize, kSize, GL_COLOR_BUFFER_BIT, GL_NEAREST);
+ ASSERT_GL_NO_ERROR();
+
+ glBindFramebuffer(GL_READ_FRAMEBUFFER, resolveFBO);
+ constexpr uint8_t kHalfPixelGradient = 256 / kSize / 2;
+ for (size_t i = 0; i < resolveTexture.size(); ++i)
+ {
+ glReadBuffer(GL_COLOR_ATTACHMENT0 + i);
+ EXPECT_PIXEL_NEAR(0, 0, kHalfPixelGradient, kHalfPixelGradient, 0, 255, 1.0);
+ EXPECT_PIXEL_NEAR(kSize - 1, 0, 255 - kHalfPixelGradient, kHalfPixelGradient, 0, 255, 1.0);
+ EXPECT_PIXEL_NEAR(0, kSize - 1, kHalfPixelGradient, 255 - kHalfPixelGradient, 0, 255, 1.0);
+ EXPECT_PIXEL_NEAR(kSize - 1, kSize - 1, 255 - kHalfPixelGradient, 255 - kHalfPixelGradient,
+ 0, 255, 1.0);
+ }
+}
+
+class FramebufferTest_ES31_MSAA : public FramebufferTest_ES31
+{
+ protected:
+ FramebufferTest_ES31_MSAA()
+ {
+ setConfigRedBits(8);
+ setConfigGreenBits(8);
+ setConfigBlueBits(8);
+ setConfigAlphaBits(8);
+ setSamples(4);
+ setMultisampleEnabled(true);
+ }
+};
+
+// Test resolving a multisampled texture with blit into multiple textures, including 3D textures,,
+// using the default framebuffer as src. With pre-rotation, this forces the Vulkan backend to take
+// a draw-based path.
+TEST_P(FramebufferTest_ES31_MSAA, MultisampleResolveWithBlitIntoMixedTextures)
+{
+ const int w = getWindowWidth();
+ const int h = getWindowHeight();
+ constexpr uint32_t kDepth = 16;
+ constexpr uint32_t kBlitSlice = 11;
+
+ ANGLE_GL_PROGRAM(gradientProgram, essl31_shaders::vs::Passthrough(),
+ essl31_shaders::fs::RedGreenGradient());
+ drawQuad(gradientProgram, essl31_shaders::PositionAttrib(), 0.5f, 1.0f, true);
... (truncated)
Loading diff…
Original Bug Report
reported by [email protected]
Vulkan Spec Violation and OOB Write in FramebufferVk::resolveColorWithCommand
Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.
Overview: A potential vulnerability in ANGLE’s Vulkan backend fails to adjust subresource parameters when resolving a multisampled framebuffer into a 3D texture layer. This causes the layer index to be incorrectly assigned to the destination’s base array layer instead of the depth offset, violating Vulkan specifications. Depending on the underlying Vulkan driver’s handling of this out-of-bounds array layer, this could potentially lead to a heap out-of-bounds write in the GPU process.
Affected files:
third_party/angle/src/libANGLE/renderer/vulkan/FramebufferVk.cpp
Estimated timestamp from git blame: 2019-08-08
Potential Out-Of-Bounds Write in ANGLE Vulkan via MSAA Resolve to 3D Texture
Summary
An issue in ANGLE’s Vulkan backend has been identified where resolving a multisampled framebuffer into a 3D texture layer (via WebGL2 blitFramebuffer) can result in a Vulkan specification violation. Specifically, the resolve command’s destination subresource parameters are not mapped correctly for 3D textures, leading to baseArrayLayer being set to the layer index while dstOffset.z is hardcoded to 0 (violating VUID-VkImageResolve-dstImage-04447 and VUID-vkCmdResolveImage-dstSubresource-01712). On vulnerable Vulkan drivers, this incorrect layer index indexing past the bounds of the 3D texture could result in a heap out-of-bounds write inside the GPU process.
Affected Code
- File:
third_party/angle/src/libANGLE/renderer/vulkan/FramebufferVk.cpp - Function:
FramebufferVk::resolveColorWithCommand
Root Cause Analysis
When a 3D texture is used as a render target, ANGLE generates a single-layer RenderTargetVk representing the specific selected depth slice. Its getLayerIndex() returns the depth slice index N (where 0 <= N < depth).
During an outside-render-pass resolve operation, FramebufferVk::resolveColorWithCommand configures the VkImageResolve parameters as follows:
// third_party/angle/src/libANGLE/renderer/vulkan/FramebufferVk.cpp
resolveRegion.dstSubresource.layerCount = 1;
resolveRegion.dstOffset.x = params.blitArea.x;
resolveRegion.dstOffset.y = params.blitArea.y;
resolveRegion.dstOffset.z = 0; // Always 0; never adjusted for 3D texture slices
...
for (size_t colorIndexGL : mState.getEnabledDrawBuffers()) {
RenderTargetVk *drawRenderTarget = mRenderTargetCache.getColors()[colorIndexGL];
vk::ImageHelper &dstImage = drawRenderTarget->getImageForWrite();
vk::LevelIndex levelVk = dstImage.toVkLevel(drawRenderTarget->getLevelIndex());
resolveRegion.dstSubresource.mipLevel = levelVk.get();
resolveRegion.dstSubresource.baseArrayLayer = drawRenderTarget->getLayerIndex(); // <-- Potential Bug: No 3D guard
srcImage->resolve(renderer, &dstImage, resolveRegion, commandBuffer); // vkCmdResolveImage
}
For standard 2D array textures, setting baseArrayLayer to the target layer index is correct. However, for a 3D texture, the underlying VkImage is created with arrayLayers = 1 and type VK_IMAGE_TYPE_3D.
According to the Vulkan specification (VUID-VkImageResolve-dstImage-04447): > “If dstImage is of type VK_IMAGE_TYPE_3D, baseArrayLayer and layerCount of dstSubresource must be 0 and 1”
Additionally, the specification requires that baseArrayLayer + layerCount <= arrayLayers (VUID-vkCmdResolveImage-dstSubresource-01712). Because arrayLayers = 1, setting baseArrayLayer = N (where N >= 1) directly violates this rule.
While ANGLE’s sibling method blitWithCommand correctly handles 3D destinations by invoking AdjustLayersAndDepthFor3DImages (remapping baseArrayLayer into the depth offsets), resolveColorWithCommand lacks any equivalent guard.
Depending on the Vulkan driver implementation, resolving with an out-of-bounds baseArrayLayer on a VK_IMAGE_TYPE_3D destination can result in memory corruption or an out-of-bounds heap write in the GPU process.
Potential Steps to Trigger (Hypothetical)
Note: Our tooling does not yet have the ability to execute code locally; the following are suggested steps to trigger the issue:
- In a WebGL2 context, allocate a multisampled renderbuffer with
gl.renderbufferStorageMultisample(gl.RENDERBUFFER, 4, gl.RGBA8, width, height)and attach it to a source FBO. - Draw or clear into the source FBO, and call
gl.finish()to complete and flush the active render pass on the source framebuffer. - Create a 3D texture with depth
D > 1usinggl.texStorage3D(gl.TEXTURE_3D, 1, gl.RGBA8, width, height, D). - Create a destination FBO, and attach a specific slice
N(where1 <= N < D) usinggl.framebufferTextureLayer(gl.DRAW_FRAMEBUFFER, gl.COLOR_ATTACHMENT0, tex3D, 0, N). - Call
gl.blitFramebuffer(0, 0, width, height, 0, 0, width, height, gl.COLOR_BUFFER_BIT, gl.NEAREST). - This forces ANGLE to resolve outside of a render pass via
resolveColorWithCommand, recordingvkCmdResolveImagewithdstSubresource.baseArrayLayer = Nand violating the Vulkan specification.
Suggested Fix
To correct this, check if the destination image is of type VK_IMAGE_TYPE_3D inside resolveColorWithCommand, and if so, adjust the subresource parameters appropriately (setting baseArrayLayer to 0 and routing the slice index into dstOffset.z).
For example:
const bool isDst3D = dstImage.getType() == VK_IMAGE_TYPE_3D;
if (isDst3D)
{
resolveRegion.dstOffset.z = drawRenderTarget->getLayerIndex();
resolveRegion.dstSubresource.baseArrayLayer = 0;
}
else
{
resolveRegion.dstOffset.z = 0;
resolveRegion.dstSubresource.baseArrayLayer = drawRenderTarget->getLayerIndex();
}
Evaluated with Chrome root at commit: 84065d9121f6e48f67755f0ae963cc09617e5c85
Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:
- If you are familiar with the severity guidelines, you may adjust the severity.
- If this is a false positive, and there’s no work to be done, please close as WAI.
- If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.
Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.
References
On This Page