Chrome · ANGLE
CVE-2026-14044
UAF in ANGLE
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
src/libGLESv2/egl_ext_stubs.cppsrc/libGLESv2/egl_stubs.cpp
Patch
From a17389c0182affe7dc3863efe0ff4aa0e48178e0 Mon Sep 17 00:00:00 2001
From: Shahbaz Youssefi <syoussefi@chromium.org>
Date: Tue, 12 May 2026 15:23:44 -0400
Subject: [PATCH] Stop revalidating the sync object in ClientWaitSync
The entry point already gets the sync object to operate on, so the error
paths can directly use that instead of calling `GetSyncIfValid` to
validate and get it again.
This change also makes sure that a SyncID look up is not done in the
unlocked tail of the call.
Bug: chromium:497670996
Change-Id: If8a53f947a815acd51fb172f03ae5bdfc1dc8465
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7841557
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org>
---
diff --git a/src/libGLESv2/egl_ext_stubs.cpp b/src/libGLESv2/egl_ext_stubs.cpp
index 1071199..91fb652 100644
--- a/src/libGLESv2/egl_ext_stubs.cpp
+++ b/src/libGLESv2/egl_ext_stubs.cpp
@@ -32,21 +32,20 @@
GetDisplayIfValid(display), EGL_FALSE);
gl::Context *currentContext = thread->getContext();
EGLint syncStatus = EGL_FALSE;
- Sync *sync = display->getSync(syncID);
- ANGLE_EGL_TRY_RETURN(thread,
- sync->clientWait(display, currentContext, flags, timeout, &syncStatus),
- "eglClientWaitSyncKHR", GetSyncIfValid(display, syncID), EGL_FALSE);
+ Sync *syncObject = display->getSync(syncID);
+ ANGLE_EGL_TRY_RETURN(
+ thread, syncObject->clientWait(display, currentContext, flags, timeout, &syncStatus),
+ "eglClientWaitSyncKHR", syncObject, EGL_FALSE);
// When performing CPU wait through UnlockedTailCall we need to handle any error conditions
if (egl::Display::GetCurrentThreadUnlockedTailCall()->any())
{
- auto handleErrorStatus = [thread, display, syncID](void *result) {
+ auto handleErrorStatus = [thread, syncObject](void *result) {
EGLint *eglResult = static_cast<EGLint *>(result);
ASSERT(eglResult);
if (*eglResult == EGL_FALSE)
{
- thread->setError(egl::Error(EGL_BAD_ALLOC), "eglClientWaitSyncKHR",
- GetSyncIfValid(display, syncID));
+ thread->setError(egl::Error(EGL_BAD_ALLOC), "eglClientWaitSyncKHR", syncObject);
}
else
{
diff --git a/src/libGLESv2/egl_stubs.cpp b/src/libGLESv2/egl_stubs.cpp
index 5b50837..d9db6c8 100644
--- a/src/libGLESv2/egl_stubs.cpp
+++ b/src/libGLESv2/egl_stubs.cpp
@@ -100,18 +100,17 @@
Sync *syncObject = display->getSync(syncID);
ANGLE_EGL_TRY_RETURN(
thread, syncObject->clientWait(display, currentContext, flags, timeout, &syncStatus),
- "eglClientWaitSync", GetSyncIfValid(display, syncID), EGL_FALSE);
+ "eglClientWaitSync", syncObject, EGL_FALSE);
// When performing CPU wait through UnlockedTailCall we need to handle any error conditions
if (egl::Display::GetCurrentThreadUnlockedTailCall()->any())
{
- auto handleErrorStatus = [thread, display, syncID](void *result) {
+ auto handleErrorStatus = [thread, syncObject](void *result) {
EGLint *eglResult = static_cast<EGLint *>(result);
ASSERT(eglResult);
if (*eglResult == EGL_FALSE)
{
- thread->setError(egl::Error(EGL_BAD_ALLOC), "eglClientWaitSync",
- GetSyncIfValid(display, syncID));
+ thread->setError(egl::Error(EGL_BAD_ALLOC), "eglClientWaitSync", syncObject);
}
else
{
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page