tree 46cc583152436ebbf6194d0e5152951cd7eb4f99
parent ee1d3cf744a083c2bb4f9767e118abd92c8565c2
author Amirali Abdolrashidi <abdolrashidi@google.com> 1638812566 -0800
committer Angle LUCI CQ <angle-scoped@luci-project-accounts.iam.gserviceaccount.com> 1639611801 +0000

Vulkan: Fix the UAF issue with BufferData

* Fixed the use-after-free issue with stale buffer handles
after calling BeginTransformFeedback.
  * Added an observer for TransformFeedbackVk to update the
buffer handles when buffer's storage is changed and the buffer
update type is StorageRedefined.
* Added a function to TransformFeedbackVk::onDestroy() to
release the counter buffers in order to avoid crash due to
TransformFeedbackVk::end() not being called, e.g., as a
result of no glEndTransformFeedback() calls.

Bug: chromium:1274316
Change-Id: I8ed477f36e6ff89dd4764bb59af564c69efe33e2
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3321789
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org>
Commit-Queue: Amirali Abdolrashidi <abdolrashidi@google.com>