commit 39c05a902fda50bb0b281333e7581e5b10308032
author Antonio Maiorano <amaiorano@google.com> Tue Jun 01 00:37:40 2021 +0000
committer Tint LUCI CQ <tint-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Jun 01 00:37:40 2021 +0000
tree df4972a94f99d28f0bcf8c46ea7ee4e7406ae830
parent f534e9e692f38332f7b0661de0dca96dab1da04e

Resolver: validate vector swizzle index is valid

Bug: tint:217
Change-Id: Ie8988b68f43914d1b05d982c8aa6f8b7346e2d8f
Reviewed-on: https://dawn-review.googlesource.com/c/tint/+/52800
Kokoro: Kokoro <noreply+kokoro@google.com>
Commit-Queue: Antonio Maiorano <amaiorano@google.com>
Reviewed-by: David Neto <dneto@google.com>

src/resolver/resolver.cc

diff --git a/src/resolver/resolver.cc b/src/resolver/resolver.cc
index 99dc700..3f9a9da 100644
--- a/src/resolver/resolver.cc
+++ b/src/resolver/resolver.cc
@@ -1983,6 +1983,12 @@
               expr->member()->source().Begin() + swizzle.size());
           return false;
       }
+
+      if (swizzle.back() >= vec->size()) {
+        diagnostics_.add_error("invalid vector swizzle member",
+                               expr->member()->source());
+        return false;
+      }
     }
 
     if (size < 1 || size > 4) {