Skip to content

fix out-of-bounds read in vk_string_validate on truncated utf-8#1947

Merged
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:string-validate-truncated-utf8
Jun 24, 2026
Merged

fix out-of-bounds read in vk_string_validate on truncated utf-8#1947
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:string-validate-truncated-utf8

Conversation

@aizu-m

@aizu-m aizu-m commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

Found while running the loaders layer/extension name validation under ASAN with malformed UTF-8.

  1. on a multi-byte lead byte vk_string_validate sets num_char_bytes and then scans that many continuation bytes.
  2. the inner scan stops at max_length but never at the strings null terminator.
  3. a requested layer/extension name ending in a lone lead byte (eg 0xC2/0xE2/0xF0) makes it walk past the terminator, and the outer loop then resumes past it, so ASAN reports a heap read up to MaxLoaderStringLength (256) bytes past the buffer.
  4. stop at a null seen inside a sequence, mark it bad data and return; added a regression test that trips the old read under ASAN.

The continuation-byte scan only stops at max_length, not at the string's null terminator, so a name ending in a lone multi-byte lead byte makes it read past the terminator, up to MaxLoaderStringLength bytes beyond the buffer. Stop the scan when a null is seen inside a sequence and report it as bad data.
@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

1 similar comment
@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build queued with queue ID 16340.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3584 running.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3584 passed.

Comment thread loader/loader.c
}

VkStringErrorFlags vk_string_validate(const int max_length, const char *utf8) {
TEST_FUNCTION_EXPORT VkStringErrorFlags vk_string_validate(const int max_length, const char *utf8) {

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There should be a better way to do unit level tests. But for the time being, just exporting the function directly is simple enough to get the job done.

@charles-lunarg charles-lunarg merged commit ef26bc7 into KhronosGroup:main Jun 24, 2026
51 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants