commit cd946a034fcdc3b78bdf4215fed6abceb36d57f1
author Michael Spang <spang@chromium.org> Mon Jun 10 18:11:57 2019 -0400
committer Commit Bot <commit-bot@chromium.org> Thu Jun 20 15:42:36 2019 +0000
tree ebb557cfa5641feb77b378fb93b48b294ee857ad
parent 9420fa061188d686a2e9f26b211dcc58eef6bf3a

Vulkan: Fix out of bounds access of pWaitDstStageMask

Since a6242e4d4 ("Vulkan: Support submitting multiple semaphores"),
we can submit up to 2 semaphores at a time, but pWaitDstStageMask
is still a single value. Change it to an array of two elements to
prevent an out of bounds access.

Bug: angleproject:3289

Change-Id: I5147802ce350af7b78dbf54cfa4a9519dd495f01
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/1666347
Commit-Queue: Michael Spang <spang@chromium.org>
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org>

src/common/FixedVector.h

diff --git a/src/common/FixedVector.h b/src/common/FixedVector.h
index 764e1ad..f2c4748 100644
--- a/src/common/FixedVector.h
+++ b/src/common/FixedVector.h
@@ -64,7 +64,7 @@
 
     bool empty() const;
     size_type size() const;
-    size_type max_size() const;
+    static constexpr size_type max_size();
 
     void clear();
 
@@ -233,7 +233,7 @@
 }
 
 template <class T, size_t N, class Storage>
-typename FixedVector<T, N, Storage>::size_type FixedVector<T, N, Storage>::max_size() const
+constexpr typename FixedVector<T, N, Storage>::size_type FixedVector<T, N, Storage>::max_size()
 {
     return N;
 }

src/libANGLE/renderer/vulkan/ContextVk.cpp

diff --git a/src/libANGLE/renderer/vulkan/ContextVk.cpp b/src/libANGLE/renderer/vulkan/ContextVk.cpp
index 0ec97d9..ee67e71 100644
--- a/src/libANGLE/renderer/vulkan/ContextVk.cpp
+++ b/src/libANGLE/renderer/vulkan/ContextVk.cpp
@@ -75,19 +75,27 @@
 // Initially dumping the command graphs is disabled.
 constexpr bool kEnableCommandGraphDiagnostics = false;
 
+constexpr VkPipelineStageFlags kSubmitInfoWaitDstStageMask[] = {
+    VK_PIPELINE_STAGE_BOTTOM_OF_PIPE_BIT,
+    VK_PIPELINE_STAGE_BOTTOM_OF_PIPE_BIT,
+};
+
 void InitializeSubmitInfo(VkSubmitInfo *submitInfo,
                           const vk::PrimaryCommandBuffer &commandBuffer,
                           const std::vector<VkSemaphore> &waitSemaphores,
-                          VkPipelineStageFlags *waitStageMask,
                           const SignalSemaphoreVector &signalSemaphores)
 {
     submitInfo->sType              = VK_STRUCTURE_TYPE_SUBMIT_INFO;
     submitInfo->commandBufferCount = commandBuffer.valid() ? 1 : 0;
     submitInfo->pCommandBuffers    = commandBuffer.ptr();
 
+    static_assert(std::extent<decltype(kSubmitInfoWaitDstStageMask)>::value ==
+                      std::decay_t<decltype(signalSemaphores)>::max_size(),
+                  "Wrong size for waitStageMask");
+
     submitInfo->waitSemaphoreCount = waitSemaphores.size();
     submitInfo->pWaitSemaphores    = waitSemaphores.data();
-    submitInfo->pWaitDstStageMask  = waitStageMask;
+    submitInfo->pWaitDstStageMask  = kSubmitInfoWaitDstStageMask;
 
     submitInfo->signalSemaphoreCount = signalSemaphores.size();
     submitInfo->pSignalSemaphores    = signalSemaphores.data();
@@ -907,8 +915,7 @@
 
         // Submit the command buffer
         VkSubmitInfo submitInfo       = {};
-        VkPipelineStageFlags waitMask = VK_PIPELINE_STAGE_BOTTOM_OF_PIPE_BIT;
-        InitializeSubmitInfo(&submitInfo, commandBatch.get(), {}, &waitMask, {});
+        InitializeSubmitInfo(&submitInfo, commandBatch.get(), {}, {});
 
         ANGLE_TRY(submitFrame(submitInfo, std::move(commandBuffer)));
 
@@ -2098,9 +2105,7 @@
     }
 
     VkSubmitInfo submitInfo       = {};
-    VkPipelineStageFlags waitMask = VK_PIPELINE_STAGE_BOTTOM_OF_PIPE_BIT;
-    InitializeSubmitInfo(&submitInfo, commandBatch.get(), mWaitSemaphores, &waitMask,
-                         signalSemaphores);
+    InitializeSubmitInfo(&submitInfo, commandBatch.get(), mWaitSemaphores, signalSemaphores);
 
     ANGLE_TRY(submitFrame(submitInfo, commandBatch.release()));