diff --git a/src/compiler/translator/ParseContext.cpp b/src/compiler/translator/ParseContext.cpp index ee6b55f2e8..c0afdcbf51 100644 --- a/src/compiler/translator/ParseContext.cpp +++ b/src/compiler/translator/ParseContext.cpp @@ -6440,6 +6440,15 @@ TIntermTyped *TParseContext::addConstructor(TFunctionLookup *fnCall, const TSour ASSERT(!type.isUnsizedArray()); } + // Security: enforce the same size limits on anonymous constructor temporaries + // as on declared variables. Without this, a WebGL shader can construct + // multi-gigabyte temporaries inline and pass them to the native driver, + // bypassing kWebGLMaxPrivateVariableSizeInBytes / kWebGLMaxVariableSizeInBytes. + if (type.getBasicType() == EbtStruct || type.isArray()) + { + checkVariableSize(line, ImmutableString("constructor"), &type); + } + if (!checkConstructorArguments(line, arguments, type)) { return CreateZeroNode(type);