Bug (CVE-2016-4769) – [WebGL] Check for existing buffer exists for enabled vertex array attributes before permitting glDrawArrays to execute

• Component: WebGL
• Status: RESOLVED FIXED

[Brent Fulgham]

Fuzzing has discovered that the 'drawArrays' WebGL call can be made with an enabled vertex array attribute but without a corresponding bound array buffer. This triggers a crash in WebGL.

[Brent Fulgham]

<rdar://problem/26865535>

[Brent Fulgham]

Created attachment 283299 [details]
Patch

[Dean Jackson]

Comment on attachment 283299 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=283299&action=review

> LayoutTests/fast/canvas/webgl/webgl-drawarrays-crash-2.html:16
> +        gl.shaderSource(fragmentShader, 'highp mat4 my_mat4_0; void main() { gl_FragColor = (my_mat4_0)[0]; }');

I'm not sure if you need this (although it's a nice test by itself). I think the crasher is caused by the vertex shader accessing an attribute that hasn't been bound.

I'm actually a bit surprised that this shader compiles!

[Dean Jackson]

I think the fragment shader could just be:

void main() { gl_FragColor = vec4(1.0, 0.0, 0.0, 1.0); }

[Brent Fulgham]

(In reply to comment #4)
> I think the fragment shader could just be:
> 
> void main() { gl_FragColor = vec4(1.0, 0.0, 0.0, 1.0); }

You are right -- I'll simplify the test as you suggest.

[Brent Fulgham]

Committed r203077: <http://trac.webkit.org/changeset/203077>