PatchGap
Chrome · WebGPU › Dawn

CVE-2025-11205

OOB in WebGPU (Dawn)
High watch CVSS 8.8 chrome OOB 📄 Reporter bug report 🔧 Commit mapped

Overview

High
Severity
8.8
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactHeap buffer overflow in WebGPU
DescriptionHeap buffer overflow in WebGPU
ComponentWebGPU
Sub-componentDawn
Bug ClassOOB
Action tierwatch — corruption primitive but gated (uncommon) — not default-reachable
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker442444724
Fix commit471c3d7e4b83 (dawn) +107/-47
CWECWE-122, CWE-787 (Heap buffer overflow, Out-of-bounds write)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEVNot listed
CreditedAtte Kettunen of OUSPG
Reported2025-09-02 · bounty $25000 (per vendor advisory)
Fix landed2025-09-04 (public git)
Disclosed2025-09-30
Patch gap26 days — fix public in source before the advisory

Background

WebGPU compatibility mode
A restricted Dawn device mode (device->IsCompatibilityMode()) for older graphics APIs, which also limits the number of texture+sampler combinations per shader stage (min(maxSampledTexturesPerShaderStage, maxSamplersPerShaderStage)).
`EntryPointMetadata::bindings`
Dawn’s per-entry-point reflection data, indexed by BindGroupIndex and holding a map from BindingNumber to binding info for each bind group.
Delayed validation in reflection
When reflecting a shader with Tint, Dawn records some limit violations, such as a @group index exceeding maxBindGroups, through DelayedInvalidIf and reports them later, so reflection keeps running on data that has already broken limits.
`BindingSlot`
Dawn’s (group, binding) pair; this patch gives it ==, != and < operators so it can be stored in a std::set.

Root Cause Analysis

The commit subject places the overflow in ReflectEntryPointUsingTint. In compatibility mode, that function counted texture+sampler combinations near its end by indexing metadata->bindings[BindGroupIndex(pair.texture_binding_point.group)] for every texture/sampler pair. The group index comes straight from the shader’s @group(N) attribute. Because the “exceeds maxBindGroups” violation is only recorded as a delayed error, reflection reached this code with arbitrary group indices, such as @group(2345) in the regression test, and indexed past the bounded per-group bindings storage. The old code then dereferenced it->second without checking it != bindingGroupInfoMap.end(), which compounded the out-of-bounds access.

The fix deletes the computation and the numTextureSamplerCombinations metadata field from reflection. It moves the count into a new ComputeNumTextureSamplerCombinations() that ValidateProgrammableStage() calls at pipeline creation, and adds the missing it != end() check. The regression test expects pipeline creation to fail with “exceeds maxBindGroups”, which suggests the delayed group-limit error is raised before the new computation indexes bindings (inferred; the earlier part of ValidateProgrammableStage is not in the diff). The ShaderModule.h hunk is cut off after the removed field, so the addition of samplerAndNonSamplerTexturePairs and nonSamplerBindingPoint to EntryPointMetadata, which the new function relies on, is not shown.

Key insight
Reflection used an attacker-chosen @group index as an array index after the out-of-range group had been noted only as a deferred error, without bounds-checking the index or checking the map lookup. The fix moves the computation to pipeline validation, after limit errors are reported, and guards the map lookup.

Attack Path

  1. Get a compatibility-mode device The attacker needs a Dawn device for which IsCompatibilityMode() is true, because the removed code ran only under deviceInfo.isCompatibilityMode.
  2. Submit WGSL with huge group indices A shader declares textures at @group values far beyond maxBindGroups (the test uses 2345 and 6789) and uses them with a sampler, for example via textureSample.
  3. Reflection continues past the limit error ReflectEntryPointUsingTint records the group-limit violation as a delayed error but goes on to the texture+sampler counting loop.
  4. Out-of-bounds index in the GPU process metadata->bindings[BindGroupIndex(group)] reads past the per-group storage, and the resulting map’s find() and the unchecked it->second operate on out-of-bounds heap memory (the advisory classifies this as a heap buffer overflow).

Impact Assessment

The vendor rates this heap buffer overflow in WebGPU as High severity, and the metadata gives no in-the-wild exploitation status. The bug is in Dawn shader reflection in the GPU process and is reached from WGSL supplied by web content. It requires a WebGPU device in compatibility mode, and the diff does not show whether stock Chrome exposed compatibility mode to ordinary pages at the time or only behind a flag or origin trial. What the patch shows directly is out-of-bounds heap access driven by shader-controlled indices; turning that into GPU-process code execution or a sandbox escape is not demonstrated (inferred).

Changed Functions

FunctionChangeNotes
DAWN_SERIALIZABLE
src/dawn/native/BindingInfo.h
 modified
if
src/dawn/native/BindingInfo.h
 modified
for
src/dawn/native/Pipeline.cpp
 modified
if
src/dawn/native/Pipeline.cpp
 modified
if
src/dawn/native/ShaderModule.cpp
 modified
for
src/dawn/native/ShaderModule.cpp
 modified

Files Changed

  • src/dawn/native/BindingInfo.h
  • src/dawn/native/Pipeline.cpp
  • src/dawn/native/ShaderModule.cpp
  • src/dawn/native/ShaderModule.h

Audit Directions

  • Work done after a deferred error
    In ReflectEntryPointUsingTint and similar reflection code, look for any code that runs after a DelayedInvalidIf and still uses the offending value (a group index, a binding number, an array size) as an index.
  • Unchecked `find()` results
    Grep Dawn native for ->second or it-> after find() on per-group binding maps where the code does not compare against end().
  • Shader-controlled indices into fixed-size per-group arrays
    Audit uses of BindGroupIndex(...) built from Tint BindingPoint.group values, in bindings, layouts and per-stage counts, to confirm each is checked against kMaxBindGroups before indexing.

Patch

view commit
From 471c3d7e4b83b98ec8c0d8e2d4b566c3b7f5e43c Mon Sep 17 00:00:00 2001
From: Gregg Tavares <gman@chromium.org>
Date: Wed, 03 Sep 2025 18:52:22 -0700
Subject: [PATCH] Fix Heap-overflow in dawn ReflectEntryPointUsingTint

Note: The operators needed to be added so BindingSlot
can be used in std::set. The needed to be constexpr
so that the static_assert that converting a tint
nonSamplerBindingPoint turns into a dawn nonSamplerBindingPoint.
The clang-format off is needed because clang-format fails
on the code in BindingPoint.h

Change-Id: I1bdc075323a14bda264655e475fe6fdc074ced8a
Bug: 442444724
Fixes: 442444724
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/260455
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Commit-Queue: Gregg Tavares <gman@chromium.org>
Auto-Submit: Gregg Tavares <gman@chromium.org>
---

diff --git a/src/dawn/native/BindingInfo.h b/src/dawn/native/BindingInfo.h
index 8692406..4b51171 100644
--- a/src/dawn/native/BindingInfo.h
+++ b/src/dawn/native/BindingInfo.h
@@ -163,7 +163,27 @@
 #define BINDING_SLOT_MEMBER(X) \
     X(BindGroupIndex, group)   \
     X(BindingNumber, binding)
-DAWN_SERIALIZABLE(struct, BindingSlot, BINDING_SLOT_MEMBER){};
+// clang-format off
+DAWN_SERIALIZABLE(struct, BindingSlot, BINDING_SLOT_MEMBER){
+    constexpr bool operator==(const BindingSlot& rhs) const {
+        return group == rhs.group && binding == rhs.binding;
+    }
+
+    constexpr bool operator!=(const BindingSlot& rhs) const {
+        return !(*this == rhs);
+    }
+
+    constexpr bool operator<(const BindingSlot& rhs) const {
+        if (group < rhs.group) {
+            return true;
+        }
+        if (group > rhs.group) {
+            return false;
+        }
+        return binding < rhs.binding;
+    }
+};
+// clang-format on
 #undef BINDING_SLOT_MEMBER
 
 struct PerStageBindingCounts {
diff --git a/src/dawn/native/Pipeline.cpp b/src/dawn/native/Pipeline.cpp
index 2e67435..909eb09 100644
--- a/src/dawn/native/Pipeline.cpp
+++ b/src/dawn/native/Pipeline.cpp
@@ -28,6 +28,7 @@
 #include "dawn/native/Pipeline.h"
 
 #include <algorithm>
+#include <set>
 #include <utility>
 
 #include "absl/container/flat_hash_set.h"
@@ -43,6 +44,48 @@
 #include "src/utils/numeric.h"
 
 namespace dawn::native {
+
+namespace {
+
+// Number of texture+sampler combinations, computed as 1 for every texture+sampler
+// combination + 1 for every texture used without a sampler that wasn't previously counted.
+// Note: this is only used in compatibility mode.
+uint32_t ComputeNumTextureSamplerCombinations(const dawn::native::EntryPointMetadata& metadata) {
+    // separate sampled from non-sampled and put sampled in set
+    std::set<BindingSlot> sampledTextures;
+    std::set<BindingSlot> sampledExternalTextures;
+    std::vector<BindingSlot> nonSampled;
+    uint32_t numSamplerTexturePairs = 0;
+    uint32_t numSamplerExternalTexturePairs = 0;
+
+    for (const auto& pair : metadata.samplerAndNonSamplerTexturePairs) {
+        const auto& bindingGroupInfoMap = metadata.bindings[BindGroupIndex(pair.texture.group)];
+        const auto it = bindingGroupInfoMap.find(BindingNumber(pair.texture.binding));
+        auto isExternalTexture =
+            it != bindingGroupInfoMap.end() &&
+            std::holds_alternative<ExternalTextureBindingInfo>(it->second.bindingInfo);
+        if (isExternalTexture) {
+            ++numSamplerExternalTexturePairs;
+            sampledExternalTextures.insert(pair.texture);
+        } else if (pair.sampler == EntryPointMetadata::nonSamplerBindingPoint) {
+            nonSampled.push_back(pair.texture);
+        } else {
+            ++numSamplerTexturePairs;
+            sampledTextures.insert(pair.texture);
+        }
+    }
+
+    // count the number of non-sampled that are not referenced by sampled pairs.
+    auto numNonSampled = std::count_if(nonSampled.begin(), nonSampled.end(),
+                                       [&](const BindingSlot& nonSampledBindingPoint) {
+                                           return !sampledTextures.contains(nonSampledBindingPoint);
+                                       });
+    return numSamplerTexturePairs + numNonSampled + numSamplerExternalTexturePairs * 3 +
+           sampledExternalTextures.size();
+}
+
+}  // namespace
+
 ResultOrError<ShaderModuleEntryPoint> ValidateProgrammableStage(DeviceBase* device,
                                                                 const ShaderModuleBase* module,
                                                                 StringView entryPointName,
@@ -103,11 +146,12 @@
     const CombinedLimits& limits = device->GetLimits();
     uint32_t maxCombos =
         std::min(limits.v1.maxSampledTexturesPerShaderStage, limits.v1.maxSamplersPerShaderStage);
+    uint32_t numTextureSamplerCombinations = ComputeNumTextureSamplerCombinations(metadata);
     DAWN_INVALID_IF(
-        device->IsCompatibilityMode() && metadata.numTextureSamplerCombinations > maxCombos,
+        device->IsCompatibilityMode() && numTextureSamplerCombinations > maxCombos,
         "Entry-point uses %u texture+sampler combinations which is more than the maximum of %u "
         "combinations in compatibility mode",
-        metadata.numTextureSamplerCombinations, maxCombos);
+        numTextureSamplerCombinations, maxCombos);
 
     // Validate if overridable constants exist in shader module
     // pipelineBase is not yet constructed at this moment so iterate constants from descriptor
diff --git a/src/dawn/native/ShaderModule.cpp b/src/dawn/native/ShaderModule.cpp
index b5e8a92..67cc22b 100644
--- a/src/dawn/native/ShaderModule.cpp
+++ b/src/dawn/native/ShaderModule.cpp
@@ -29,7 +29,6 @@
 
 #include <algorithm>
 #include <limits>
-#include <set>
 #include <sstream>
 #include <utility>
 
@@ -1324,44 +1323,6 @@
 
     metadata->usesSubgroupMatrix = entryPoint.uses_subgroup_matrix;
 
-    // Compute the texture+sampler combination count.
-    if (deviceInfo.isCompatibilityMode) {
-        // separate sampled from non-sampled and put sampled in set
-        std::set<tint::BindingPoint> sampledTextures;
-        std::set<tint::BindingPoint> sampledExternalTextures;
-        std::vector<tint::BindingPoint> nonSampled;
-        uint32_t numSamplerTexturePairs = 0;
-        uint32_t numSamplerExternalTexturePairs = 0;
-
-        for (const auto& pair : samplerAndNonSamplerTextureUses) {
-            const auto& bindingGroupInfoMap =
-                metadata->bindings[BindGroupIndex(pair.texture_binding_point.group)];
-            const auto it =
-                bindingGroupInfoMap.find(BindingNumber(pair.texture_binding_point.binding));
-            auto isExternalTexture =
-                std::holds_alternative<ExternalTextureBindingInfo>(it->second.bindingInfo);
-            if (isExternalTexture) {
-                ++numSamplerExternalTexturePairs;
-                sampledExternalTextures.insert(pair.texture_binding_point);
-            } else if (pair.sampler_binding_point == tintNonSamplerBindingPoint) {
-                nonSampled.push_back(pair.texture_binding_point);
-            } else {
-                ++numSamplerTexturePairs;
-                sampledTextures.insert(pair.texture_binding_point);
-            }
-        }
-
-        // count the number of non-sampled that are not referenced by sampled pairs.
-        auto numNonSampled =
-            std::count_if(nonSampled.begin(), nonSampled.end(),
-                          [&](const tint::BindingPoint& nonSampledBindingPoint) {
-                              return !sampledTextures.contains(nonSampledBindingPoint);
-                          });
-        metadata->numTextureSamplerCombinations = numSamplerTexturePairs + numNonSampled +
-                                                  numSamplerExternalTexturePairs * 3 +
-                                                  sampledExternalTextures.size();
-    }
-
 #undef DelayedInvalidIf
     return std::move(metadata);
 }
diff --git a/src/dawn/native/ShaderModule.h b/src/dawn/native/ShaderModule.h
index a70f61a..0ec26d6 100644
--- a/src/dawn/native/ShaderModule.h
+++ b/src/dawn/native/ShaderModule.h
@@ -329,11 +329,7 @@
     X(bool, usesDepthTextureWithNonComparisonSampler)                                             \
     X(bool, usesSubgroupMatrix)                                                                   \
     /* Immediate Data block byte size */                                                          \
-    X(uint32_t, immediateDataRangeByteSize)                                                       \
-    /* Number of texture+sampler combinations, computed as 1 for every texture+sampler         */ \
-    /* combination + 1 for every texture used without a sampler that wasn't previously counted.*/ \
-    /* Note: this is only set in compatibility mode.                                           */ \
-    X(uint32_t, numTextureSamplerCombinations)
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/src/dawn/tests/unittests/validation/CompatValidationTests.cpp b/src/dawn/tests/unittests/validation/CompatValidationTests.cpp
index c163322..e3cf581 100644
--- a/src/dawn/tests/unittests/validation/CompatValidationTests.cpp
+++ b/src/dawn/tests/unittests/validation/CompatValidationTests.cpp
@@ -256,6 +256,45 @@
     }
 }
 
+// Test that large group ids don't crash
+TEST_F(CompatValidationTest, LargeGroupIds) {
+    wgpu::ShaderModule module = utils::CreateShaderModule(device, R"(
+@group(0) @binding(0) var smp: sampler;
+@group(2345) @binding(0) var tex1: texture_2d<f32>;
+@group(6789) @binding(0) var tex2: texture_2d<f32>;
+
+@vertex fn vs() -> @builtin(position) vec4f {
+    let c = textureLoad(tex1, vec2u(0), 0) + textureLoad(tex2, vec2u(0), 0);
+    return c;
+}
+
+@fragment fn fs() -> @location(0) vec4f {
+    let c = textureSample(tex1, smp, vec2f(0)) + textureSample(tex2, smp, vec2f(0));
+    return c;
+}
+
+@compute @workgroup_size(1) fn main() {
+    let c = textureSampleLevel(tex1, smp, vec2f(0), 0) + textureSampleLevel(tex2, smp, vec2f(0), 0);
+})");
+
+    {
+        wgpu::ComputePipelineDescriptor pDesc;
+        pDesc.compute.module = module;
+        ASSERT_DEVICE_ERROR(device.CreateComputePipeline(&pDesc),
+                            testing::HasSubstr("exceeds maxBindGroups"));
+    }
+    {
+        utils::ComboRenderPipelineDescriptor pDesc;
+        pDesc.vertex.module = module;
+        pDesc.cFragment.module = module;
+        pDesc.cFragment.targetCount = 1;
+        pDesc.cTargets[0].format = wgpu::TextureFormat::RGBA8Unorm;
+
+        ASSERT_DEVICE_ERROR(device.CreateRenderPipeline(&pDesc),
+                            testing::HasSubstr("exceeds maxBindGroups"));
+    }
+}
+
 TEST_F(CompatValidationTest, CanNotCreatePipelineWithDepthTextureUsedWithNonComparisonSampler) {
     wgpu::ShaderModule module = utils::CreateShaderModule(device, R"(
         @group(1) @binding(0) var s: sampler;
Loading diff…

Original Bug Report

reported by at...@gmail.com

Heap-buffer-overflow/wild-read in dawn::native::`anonymous namespace'::ReflectEntryPointUsingTint

Tested on: Chromium: 141.0.7379.0 (Developer Build) (64-bit) OS: Windows 11 Version 24H2 (Build 26100.4946)

GPU-info: Integrated AMD Radeon Graphics of AMD Ryzen 5 5625U

To reproduce run attached .html with ‘–enable-experimental-web-platform-features’ flag.

chromium-141.0.7379.0-win64-asan\chrome.exe –enable-experimental-web-platform-features heap-buffer-overflow-dawnnativeReflectEntryPointUsingTint.html

Reproduces also on Ubuntu 22.04 with ‘–enable-unsafe-webgpu’, but doesn’t require ‘–enable-experimental-web-platform-features’.

ASAN-trace:

==18232==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x1207e5f47bc0 at pc 0x7ffd880d6c79 bp 0x000893ffd030 sp 0x000893ffd078 READ of size 8 at 0x1207e5f47bc0 thread T0 SCARINESS: 33 (8-byte-read-heap-buffer-overflow-far-from-bounds) #0 0x7ffd880d6c78 in absl::container_internal::raw_hash_set<absl::container_internal::FlatHashMapPolicy<unsigned int,dawn::native::ShaderBindingInfo>,absl::hash_internal::Hash<unsigned int>,std::__Cr::equal_to<unsigned int>,std::__Cr::allocator<std::_Cr::pair<const unsigned int,dawn::native::ShaderBindingInfo> > >::find<unsigned int> C:\b\s\w\ir\cache\builder\src\third party\abseil-cpp\absl\container\internal\raw_hash_set.h:2815 #1 0x7ffd880ce340 in dawn::native::anonymous namespace'::ReflectEntryPointUsingTint C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\ShaderModule.cpp:1316 #2 0x7ffd880bbe2c in dawn::native::ParseShaderModule C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\ShaderModule.cpp:1571 #3 0x7ffd87f69109 in dawn::native::LoadOrRun&lt;dawn::Result<dawn::native::ShaderModuleParseResult,dawn::native::ErrorData> (*)(dawn::native::Blob),dawn::Result<dawn::native::ShaderModuleParseResult,dawn::native::ErrorData> (*)(dawn::native::ShaderModuleParseRequest)&gt; C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\CacheRequest.h:165 #4 0x7ffd87f33d7b in dawn::native::DeviceBase::CreateShaderModule C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Device.cpp:2231 #5 0x7ffd87f49789 in dawn::native::DeviceBase::APICreateShaderModule C:\b\s\w\ir\cache\builder\src\third_party\dawn\src\dawn\native\Device.cpp:1448 #6 0x7ffd9dc610bd in dawn::wire::server::Server::DoDeviceCreateShaderModule C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\src\dawn\wire\server\ServerDoers_autogen.cpp:328 #7 0x7ffd9dc73e24 in dawn::wire::server::Server::HandleDeviceCreateShaderModule C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\src\dawn\wire\server\ServerHandlers_autogen.cpp:643 #8 0x7ffd9dc78acb in dawn::wire::server::Server::HandleCommandsImpl C:\b\s\w\ir\cache\builder\src\out\069a-Win_ASan_Releas\gen\third_party\dawn\src\dawn\wire\server\ServerHandlers_autogen.cpp:1706 #9 0x7ffd9dc97412 in gpu::webgpu::anonymous namespace’::DawnWireServer::HandleCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:156 #10 0x7ffd9dc97865 in gpu::webgpu::anonymous namespace'::WebGPUDecoderImpl::HandleDawnCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1963 #11 0x7ffd9dc8d201 in gpu::webgpu::anonymous namespace’::WebGPUDecoderImpl::DoCommands C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\webgpu_decoder_impl.cc:1908 #12 0x7ffd88c18213 in gpu::CommandBufferService::Flush C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\command_buffer_service.cc:266 #13 0x7ffd9dd269de in gpu::CommandBufferStub::OnAsyncFlush C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:495 #14 0x7ffd9dd258e5 in gpu::CommandBufferStub::ExecuteDeferredRequest C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\command_buffer_stub.cc:162 #15 0x7ffd9dcf0beb in gpu::GpuChannel::ExecuteDeferredRequest C:\b\s\w\ir\cache\builder\src\gpu\ipc\service\gpu_channel.cc:848 #16 0x7ffd9dd00b83 in base::internal::Invoker<base::internal::FunctorTraits<void (GpuChannel::*&&)(mojo::StructPtrgpu::mojom::DeferredRequestParams, gpu::FenceSyncReleaseDelegate ),base::WeakPtrgpu::GpuChannel &&,mojo::StructPtrgpu::mojom::DeferredRequestParams &&>,base::internal::BindState<1,1,0,void (GpuChannel::)(mojo::StructPtr<gpu::mojom::DeferredRequestPara ms>, gpu::FenceSyncReleaseDelegate *),base::WeakPtrgpu::GpuChannel,mojo::StructPtrgpu::mojom::DeferredRequestParams >,void (gpu::FenceSyncReleaseDelegate *)>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973 #17 0x7ffd88c5839d in base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)> &&,gpu::FenceSyncReleaseDelegate *>,base::internal::BindState<0,1,1,base::OnceCallback<void (gpu::FenceSyncReleaseDelegate *)>,base::internal::UnretainedWrappergpu::FenceSyncReleaseDelegate,base::unretained_traits::MayNotDangle,0 >,void ()>::RunImpl<base::OnceCallback<void (gpu::FenceSyncReleaseDelegate )>,std::__Cr::tuple<base::internal::UnretainedWrappergpu::FenceSyncReleaseDelegate,base::unretained_traits::MayNotDangle,0 >,0> C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:1060 #18 0x7ffd88c2bfd0 in gpu::Scheduler::ExecuteSequence C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:672 #19 0x7ffd88c29c6d in gpu::Scheduler::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:594 #20 0x7ffd88c2f468 in base::internal::Invoker<base::internal::FunctorTraits<void (Scheduler::&&)(),gpu::Scheduler >,base::internal::BindState<1,1,0,void (Scheduler::)(),base::internal::UnretainedWrappergpu::Scheduler,base::unretained_traits::MayNotDangle,0 >,void ()>::RunOnce C:\b\s\w\ir\cache\builder\src\base\functional\bind_internal.h:973 #21 0x7ffd98e138c3 in base::TaskAnnotator::RunTaskImpl C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:207 #22 0x7ffd98de6a19 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:472 #23 0x7ffd98de58bf in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:346 #24 0x7ffd98f48b32 in base::MessagePumpDefault::Run C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:42 #25 0x7ffd98de8761 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:647 #26 0x7ffd98e8638e in base::RunLoop::Run C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:134 #27 0x7ffda2326ab5 in content::GpuMain C:\b\s\w\ir\cache\builder\src\content\gpu\gpu_main.cc:474 #28 0x7ffd94f18a40 in content::RunOtherNamedProcessTypeMain C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:763 #29 0x7ffd94f1ae73 in content::ContentMainRunnerImpl::Run C:\b\s\w\ir\cache\builder\src\content\app\content_main_runner_impl.cc:1129 #30 0x7ffd94f0f3cf in content::RunContentProcess C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:346 #31 0x7ffd94f0f95d in content::ContentMain C:\b\s\w\ir\cache\builder\src\content\app\content_main.cc:359 #32 0x7ffd85cd301f in ChromeMain C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_main.cc:228 #33 0x7ff76a84479b in MainDllLoader::Launch C:\b\s\w\ir\cache\builder\src\chrome\app\main_dll_loader_win.cc:201 #34 0x7ff76a84200c in main C:\b\s\w\ir\cache\builder\src\chrome\app\chrome_exe_main_win.cc:352 #35 0x7ff76acffa2f in __scrt_common_main_seh D:\a_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #36 0x7ffeb034e8d6 in BaseThreadInitThunk+0x16 (C:\WINDOWS\System32\KERNEL32.DLL+0x18002e8d6) #37 0x7ffeb1d5c34b in RtlUserThreadStart+0x2b (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18003c34b) Address 0x1207e5f47bc0 is a wild pointer inside of access range of size 0x000000000008. SUMMARY: AddressSanitizer: heap-buffer-overflow C:\b\s\w\ir\cache\builder\src\third_party\abseil-cpp\absl\container\internal\raw_hash_set.h:2815 in absl::container_internal::raw_hash_set<absl::container_internal::FlatHashMapPolicy<unsigned int,dawn::native::ShaderBindingInfo>,absl::hash_internal::Hash<unsigned int>,std::__Cr::equal_to<unsigned int>,std::__Cr::allocator<std:: __Cr::pair<const unsigned int,dawn::native::ShaderBindingInfo> > >::find<unsigned int> Shadow bytes around the buggy address: 0x1207e5f47900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47a00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa =>0x1207e5f47b80: fa fa fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa 0x1207e5f47c00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa f7 fa 0x1207e5f47c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47d00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1207e5f47e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==18232==ADDITIONAL INFO ==18232==Note: Please include this section with the ASan report. Task trace: #0 0x7ffd88c2a1fc in gpu::Scheduler::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:610 #1 0x7ffd88c2a1fc in gpu::Scheduler::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:610 #2 0x7ffd88c2a1fc in gpu::Scheduler::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:610 #3 0x7ffd88c2a1fc in gpu::Scheduler::RunNextTask C:\b\s\w\ir\cache\builder\src\gpu\command_buffer\service\scheduler.cc:610 Command line: "chromium-141.0.7379.0-win64-asan\chrome.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAMAAAwAAAAAAAAAAAAAAAAAAABIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1856,i,16049326817075466414,7205898037398527891,262144 - -field-trial-handle=1960,i,2671077517126853030,12550265571060057205,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,CookieIndicesHeader,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPolicyNegotiation,EnableCanvas2DLayer s,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PartitionedPopins,PrefetchCookieIndices,PrivateNetworkAccessRespectPreflightResults,ThirdPartyStoragePartitioning --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2 ==18232==END OF ADDITIONAL INFO ==18232==ABORTING

View on issue tracker
Uploaded PoC files
On This Page