vulkan: vkBindImageMemory() should filter invalid inputs. In vkBindImageMemory(), if VkImage / VkMemory is null or invalid handle, it could crash the host emulator. Instead we would like to return an error value so that the guest could exit gracefully. Bug: fxbug.dev/93576 Change-Id: Iabd9eebead37dffb902ffc237adf66406edea5ec
diff --git a/system/vulkan_enc/ResourceTracker.cpp b/system/vulkan_enc/ResourceTracker.cpp index ed6374b..eafea8f 100644 --- a/system/vulkan_enc/ResourceTracker.cpp +++ b/system/vulkan_enc/ResourceTracker.cpp
@@ -27,6 +27,7 @@ #include "../OpenglSystemCommon/EmulatorFeatureInfo.h" #include "../OpenglSystemCommon/HostConnection.h" +#include "vulkan/vulkan_core.h" /// Use installed headers or locally defined Fuchsia-specific bits #ifdef VK_USE_PLATFORM_FUCHSIA @@ -5965,6 +5966,11 @@ VkDevice device, VkImage image, VkDeviceMemory memory, VkDeviceSize memoryOffset) { VkEncoder* enc = (VkEncoder*)context; + // Do not forward calls with invalid handles to host. + if (info_VkDeviceMemory.find(memory) == info_VkDeviceMemory.end() || + info_VkImage.find(image) == info_VkImage.end()) { + return VK_ERROR_OUT_OF_DEVICE_MEMORY; + } return enc->vkBindImageMemory(device, image, memory, memoryOffset, true /* do lock */); } @@ -5972,6 +5978,13 @@ void* context, VkResult, VkDevice device, uint32_t bindingCount, const VkBindImageMemoryInfo* pBindInfos) { VkEncoder* enc = (VkEncoder*)context; + // Do not forward calls with invalid handles to host. + if (!pBindInfos || + info_VkDeviceMemory.find(pBindInfos->memory) == + info_VkDeviceMemory.end() || + info_VkImage.find(pBindInfos->image) == info_VkImage.end()) { + return VK_ERROR_OUT_OF_DEVICE_MEMORY; + } return enc->vkBindImageMemory2(device, bindingCount, pBindInfos, true /* do lock */); } @@ -5979,6 +5992,13 @@ void* context, VkResult, VkDevice device, uint32_t bindingCount, const VkBindImageMemoryInfo* pBindInfos) { VkEncoder* enc = (VkEncoder*)context; + // Do not forward calls with invalid handles to host. + if (!pBindInfos || + info_VkDeviceMemory.find(pBindInfos->memory) == + info_VkDeviceMemory.end() || + info_VkImage.find(pBindInfos->image) == info_VkImage.end()) { + return VK_ERROR_OUT_OF_DEVICE_MEMORY; + } return enc->vkBindImageMemory2KHR(device, bindingCount, pBindInfos, true /* do lock */); }