commit 3ee18513bd153f455d0709a5ec8f044866298337
author dan sinclair <dsinclair@chromium.org> Tue Sep 23 08:24:44 2025 -0700
committer Dawn LUCI CQ <dawn-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Sep 23 08:24:44 2025 -0700
tree 9c1f82897fa5d3bbda5f0259ab0de0111758f6e3
parent 5f4e48d67eb7d94e9c2375c398f2073292747a2c

Validate pointers have a store type.

The StoreType for a pointer must not be a `nullptr` when decoding the
protobuf.

Fixed: 446725508
Change-Id: Ica0e4476d4ef2d9aad96bcf8bc18384605de9bbf
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/263114
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: James Price <jrprice@google.com>
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Auto-Submit: dan sinclair <dsinclair@chromium.org>
Commit-Queue: dan sinclair <dsinclair@chromium.org>
Commit-Queue: James Price <jrprice@google.com>

src/tint/lang/core/ir/binary/decode.cc

diff --git a/src/tint/lang/core/ir/binary/decode.cc b/src/tint/lang/core/ir/binary/decode.cc
index c252af6..febf5f6 100644
--- a/src/tint/lang/core/ir/binary/decode.cc
+++ b/src/tint/lang/core/ir/binary/decode.cc
@@ -789,9 +789,14 @@
         return mod_out_.Types().mat(column_ty, matrix_in.num_columns());
     }
 
-    const type::Pointer* CreateTypePointer(const pb::TypePointer& pointer_in) {
+    const type::Type* CreateTypePointer(const pb::TypePointer& pointer_in) {
         auto address_space = AddressSpace(pointer_in.address_space());
         auto* store_ty = Type(pointer_in.store_type());
+        if (!store_ty) {
+            err_ << "pointer must have a store type\n";
+            return mod_out_.Types().invalid();
+        }
+
         auto access = AccessControl(pointer_in.access());
         return mod_out_.Types().ptr(address_space, store_ty, access);
     }