Chrome · ANGLE
CVE-2026-9901
UAF in ANGLE
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
src/libANGLE/Texture.cppsrc/tests/angle_end2end_tests_expectations.txtsrc/tests/gl_tests/ClearTest.cppsrc/tests/gl_tests/FramebufferTest.cpp
Patch
From ca3d0ccbebb58f04ca7a04315f0f2137c1b92bd0 Mon Sep 17 00:00:00 2001
From: Shahbaz Youssefi <syoussefi@chromium.org>
Date: Tue, 28 Apr 2026 16:44:26 -0400
Subject: [PATCH] Notify dirty bit on storage image / MSRTT bind
A number of changes to a texture may cause its backing storage to be
reallocated. For example, a change to base/max level, enablement of
mipmapping, srgb override etc. Typically, these changes signal
the observers that the texture is dirty.
Two of these changes in particular, when a texture is bound as storage
image and when it's attached to an MSRTT framebuffer, did not generate
such a signal. As a result, the framebuffer could get out of sync with
its attachments.
Bug: chromium:497737770
Change-Id: I8b404ea9a993cd6009048621687cd1df35ad63ff
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7812735
Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org>
Reviewed-by: Charlie Lao <cclao@google.com>
Reviewed-by: Geoff Lang <geofflang@chromium.org>
---
diff --git a/src/libANGLE/Texture.cpp b/src/libANGLE/Texture.cpp
index ae705c7..dbfbb56 100644
--- a/src/libANGLE/Texture.cpp
+++ b/src/libANGLE/Texture.cpp
@@ -2744,6 +2744,10 @@
void Texture::onBindToMSRTTFramebuffer()
{
+ if (!mState.mHasBeenBoundToMSRTTFramebuffer)
+ {
+ onStateChange(angle::SubjectMessage::SubjectChanged);
+ }
mState.mHasBeenBoundToMSRTTFramebuffer = true;
}
@@ -2798,6 +2802,7 @@
{
mDirtyBits.set(DIRTY_BIT_BOUND_AS_IMAGE);
mState.mHasBeenBoundAsImage = true;
+ onStateChange(angle::SubjectMessage::SubjectChanged);
}
}
diff --git a/src/tests/angle_end2end_tests_expectations.txt b/src/tests/angle_end2end_tests_expectations.txt
index 87e2666..9ed9412 100644
--- a/src/tests/angle_end2end_tests_expectations.txt
+++ b/src/tests/angle_end2end_tests_expectations.txt
@@ -843,6 +843,7 @@
42267029 PIXEL6 VULKAN : VulkanPerformanceCounterTest_DepthStencilLoadStoreOps.RenderToTextureDepthStencilRenderbufferShouldNotLoad/* = SKIP
42267029 PIXEL6 VULKAN : VulkanPerformanceCounterTest.RenderToTextureDepthStencilTextureShouldNotLoad/* = SKIP
42267029 PIXEL6 VULKAN : VulkanPerformanceCounterTest_DepthStencilLoadStoreOps.RenderToTextureUninitializedAndUnusedDepthStencil/* = SKIP
+509210196 PIXEL6 VULKAN : FramebufferTest_ES31.AttachToMultipleCubeFacesThenMSRTT/* = SKIP
// New failures after AP1A.240405.002 upgrade
336847261 PIXEL6 VULKAN : StateChangeTestES3.LineWidth/* = SKIP
diff --git a/src/tests/gl_tests/ClearTest.cpp b/src/tests/gl_tests/ClearTest.cpp
index 2817f45..c5156c1 100644
--- a/src/tests/gl_tests/ClearTest.cpp
+++ b/src/tests/gl_tests/ClearTest.cpp
@@ -1660,6 +1660,74 @@
glClear(GL_COLOR_BUFFER_BIT);
EXPECT_PIXEL_NEAR(0, 0, 128, 128, 128, 128, 1.0);
+ ASSERT_GL_NO_ERROR();
+}
+
+// Test uploading to a texture then immediately clearing it
+TEST_P(ClearTest, TextureUploadThenClear)
+{
+ glBindFramebuffer(GL_FRAMEBUFFER, mFBOs[0]);
+
+ GLTexture texture;
+
+ constexpr uint32_t kSize = 16;
+ std::vector<GLColor> pixelData(kSize * kSize, GLColor::blue);
+ glBindTexture(GL_TEXTURE_2D, texture);
+ glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kSize, kSize, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ pixelData.data());
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, texture, 0);
+
+ glClearColor(1, 0, 0, 1);
+ glClear(GL_COLOR_BUFFER_BIT);
+
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
+ ASSERT_GL_NO_ERROR();
+}
+
+// Test uploading to a texture then immediately clearing some components of it
+TEST_P(ClearTest, TextureUploadThenComponentClear)
+{
+ glBindFramebuffer(GL_FRAMEBUFFER, mFBOs[0]);
+
+ GLTexture texture;
+
+ constexpr uint32_t kSize = 16;
+ std::vector<GLColor> pixelData(kSize * kSize, GLColor::blue);
+ glBindTexture(GL_TEXTURE_2D, texture);
+ glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kSize, kSize, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ pixelData.data());
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, texture, 0);
+
+ glColorMask(GL_TRUE, GL_FALSE, GL_FALSE, GL_TRUE);
+ glClearColor(1, 1, 0, 1);
+ glClear(GL_COLOR_BUFFER_BIT);
+
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::magenta);
+ ASSERT_GL_NO_ERROR();
+}
+
+// Test uploading to a texture then immediately clearing a scissored region of it
+TEST_P(ClearTest, TextureUploadThenScissoredClear)
+{
+ glBindFramebuffer(GL_FRAMEBUFFER, mFBOs[0]);
+
+ GLTexture texture;
+
+ constexpr uint32_t kSize = 16;
+ std::vector<GLColor> pixelData(kSize * kSize, GLColor::blue);
+ glBindTexture(GL_TEXTURE_2D, texture);
+ glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kSize, kSize, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ pixelData.data());
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, texture, 0);
+
+ glEnable(GL_SCISSOR_TEST);
+ glScissor(0, 0, kSize / 2, kSize);
+ glClearColor(1, 0, 0, 1);
+ glClear(GL_COLOR_BUFFER_BIT);
+
+ EXPECT_PIXEL_RECT_EQ(0, 0, kSize / 2, kSize, GLColor::red);
+ EXPECT_PIXEL_RECT_EQ(kSize / 2, 0, kSize - kSize / 2, kSize, GLColor::blue);
+ ASSERT_GL_NO_ERROR();
}
// Test to validate that we can go from an RGBA framebuffer attachment, to an RGB one and still
diff --git a/src/tests/gl_tests/FramebufferTest.cpp b/src/tests/gl_tests/FramebufferTest.cpp
index 72bf13c..a029996 100644
--- a/src/tests/gl_tests/FramebufferTest.cpp
+++ b/src/tests/gl_tests/FramebufferTest.cpp
@@ -9044,6 +9044,347 @@
ASSERT_GL_NO_ERROR();
}
+// Verify that recreating a texture's backing image due to use as storage image works when a
+// framebuffer is attached to multiple faces of the same cubemap.
+TEST_P(FramebufferTest_ES31, AttachToMultipleCubeFacesThenBindAsStorageImage)
+{
+ constexpr char kFS[] = R"(#version 310 es
+precision mediump float;
+layout(location = 0) out vec4 o0;
+layout(location = 1) out vec4 o1;
+void main()
+{
+ o0 = vec4(1.0, 0.0, 0.0, 1.0);
+ o1 = vec4(0.0, 1.0, 0.0, 1.0);
+})";
+ ANGLE_GL_PROGRAM(program, essl31_shaders::vs::Simple(), kFS);
+ glUseProgram(program);
+
+ // Create a cube map, and attach a framebuffer to two faces of it.
+ GLTexture cube;
+ glBindTexture(GL_TEXTURE_CUBE_MAP, cube);
+ glTexStorage2D(GL_TEXTURE_CUBE_MAP, 1, GL_RGBA8, 6, 6);
+ ASSERT_GL_NO_ERROR();
+
+ GLFramebuffer fbo;
+ glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_CUBE_MAP_POSITIVE_X,
+ cube, 0);
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT1, GL_TEXTURE_CUBE_MAP_NEGATIVE_X,
+ cube, 0);
+ constexpr GLenum kDrawBufs[2] = {GL_COLOR_ATTACHMENT0, GL_COLOR_ATTACHMENT1};
+ glDrawBuffers(2, kDrawBufs);
+ ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER);
+ ASSERT_GL_NO_ERROR();
+
+ // Draw once to flush all dirty bits.
+ drawQuad(program, essl31_shaders::PositionAttrib(), 0.5f);
+
+ // Bind the texture as a storage image. This can trigger a recreation of the backing image of
+ // the texture.
+ glBindImageTexture(0, cube, 0, GL_FALSE, 0, GL_READ_WRITE, GL_RGBA8);
+ ASSERT_GL_NO_ERROR();
+
+ // Change one of the attachments to dirty it, but not the other one.
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_CUBE_MAP_POSITIVE_Y,
+ cube, 0);
+
+ // Draw again. If the backing image is recreated, both framebuffer attachments must be updated.
+ drawQuad(program, essl31_shaders::PositionAttrib(), 0.5f);
+ glReadBuffer(GL_COLOR_ATTACHMENT0);
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
+ glReadBuffer(GL_COLOR_ATTACHMENT1);
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::green);
+
+ // Verify the first draw was also done correctly
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_CUBE_MAP_POSITIVE_X,
+ cube, 0);
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/src/tests/angle_end2end_tests_expectations.txt b/src/tests/angle_end2end_tests_expectations.txt
index 87e2666..9ed9412 100644
--- a/src/tests/angle_end2end_tests_expectations.txt
+++ b/src/tests/angle_end2end_tests_expectations.txt
@@ -843,6 +843,7 @@
42267029 PIXEL6 VULKAN : VulkanPerformanceCounterTest_DepthStencilLoadStoreOps.RenderToTextureDepthStencilRenderbufferShouldNotLoad/* = SKIP
42267029 PIXEL6 VULKAN : VulkanPerformanceCounterTest.RenderToTextureDepthStencilTextureShouldNotLoad/* = SKIP
42267029 PIXEL6 VULKAN : VulkanPerformanceCounterTest_DepthStencilLoadStoreOps.RenderToTextureUninitializedAndUnusedDepthStencil/* = SKIP
+509210196 PIXEL6 VULKAN : FramebufferTest_ES31.AttachToMultipleCubeFacesThenMSRTT/* = SKIP
// New failures after AP1A.240405.002 upgrade
336847261 PIXEL6 VULKAN : StateChangeTestES3.LineWidth/* = SKIP
diff --git a/src/tests/gl_tests/ClearTest.cpp b/src/tests/gl_tests/ClearTest.cpp
index 2817f45..c5156c1 100644
--- a/src/tests/gl_tests/ClearTest.cpp
+++ b/src/tests/gl_tests/ClearTest.cpp
@@ -1660,6 +1660,74 @@
glClear(GL_COLOR_BUFFER_BIT);
EXPECT_PIXEL_NEAR(0, 0, 128, 128, 128, 128, 1.0);
+ ASSERT_GL_NO_ERROR();
+}
+
+// Test uploading to a texture then immediately clearing it
+TEST_P(ClearTest, TextureUploadThenClear)
+{
+ glBindFramebuffer(GL_FRAMEBUFFER, mFBOs[0]);
+
+ GLTexture texture;
+
+ constexpr uint32_t kSize = 16;
+ std::vector<GLColor> pixelData(kSize * kSize, GLColor::blue);
+ glBindTexture(GL_TEXTURE_2D, texture);
+ glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kSize, kSize, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ pixelData.data());
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, texture, 0);
+
+ glClearColor(1, 0, 0, 1);
+ glClear(GL_COLOR_BUFFER_BIT);
+
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
+ ASSERT_GL_NO_ERROR();
+}
+
+// Test uploading to a texture then immediately clearing some components of it
+TEST_P(ClearTest, TextureUploadThenComponentClear)
+{
+ glBindFramebuffer(GL_FRAMEBUFFER, mFBOs[0]);
+
+ GLTexture texture;
+
+ constexpr uint32_t kSize = 16;
+ std::vector<GLColor> pixelData(kSize * kSize, GLColor::blue);
+ glBindTexture(GL_TEXTURE_2D, texture);
+ glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kSize, kSize, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ pixelData.data());
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, texture, 0);
+
+ glColorMask(GL_TRUE, GL_FALSE, GL_FALSE, GL_TRUE);
+ glClearColor(1, 1, 0, 1);
+ glClear(GL_COLOR_BUFFER_BIT);
+
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::magenta);
+ ASSERT_GL_NO_ERROR();
+}
+
+// Test uploading to a texture then immediately clearing a scissored region of it
+TEST_P(ClearTest, TextureUploadThenScissoredClear)
+{
+ glBindFramebuffer(GL_FRAMEBUFFER, mFBOs[0]);
+
+ GLTexture texture;
+
+ constexpr uint32_t kSize = 16;
+ std::vector<GLColor> pixelData(kSize * kSize, GLColor::blue);
+ glBindTexture(GL_TEXTURE_2D, texture);
+ glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, kSize, kSize, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+ pixelData.data());
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, texture, 0);
+
+ glEnable(GL_SCISSOR_TEST);
+ glScissor(0, 0, kSize / 2, kSize);
+ glClearColor(1, 0, 0, 1);
+ glClear(GL_COLOR_BUFFER_BIT);
+
+ EXPECT_PIXEL_RECT_EQ(0, 0, kSize / 2, kSize, GLColor::red);
+ EXPECT_PIXEL_RECT_EQ(kSize / 2, 0, kSize - kSize / 2, kSize, GLColor::blue);
+ ASSERT_GL_NO_ERROR();
}
// Test to validate that we can go from an RGBA framebuffer attachment, to an RGB one and still
diff --git a/src/tests/gl_tests/FramebufferTest.cpp b/src/tests/gl_tests/FramebufferTest.cpp
index 72bf13c..a029996 100644
--- a/src/tests/gl_tests/FramebufferTest.cpp
+++ b/src/tests/gl_tests/FramebufferTest.cpp
@@ -9044,6 +9044,347 @@
ASSERT_GL_NO_ERROR();
}
+// Verify that recreating a texture's backing image due to use as storage image works when a
+// framebuffer is attached to multiple faces of the same cubemap.
+TEST_P(FramebufferTest_ES31, AttachToMultipleCubeFacesThenBindAsStorageImage)
+{
+ constexpr char kFS[] = R"(#version 310 es
+precision mediump float;
+layout(location = 0) out vec4 o0;
+layout(location = 1) out vec4 o1;
+void main()
+{
+ o0 = vec4(1.0, 0.0, 0.0, 1.0);
+ o1 = vec4(0.0, 1.0, 0.0, 1.0);
+})";
+ ANGLE_GL_PROGRAM(program, essl31_shaders::vs::Simple(), kFS);
+ glUseProgram(program);
+
+ // Create a cube map, and attach a framebuffer to two faces of it.
+ GLTexture cube;
+ glBindTexture(GL_TEXTURE_CUBE_MAP, cube);
+ glTexStorage2D(GL_TEXTURE_CUBE_MAP, 1, GL_RGBA8, 6, 6);
+ ASSERT_GL_NO_ERROR();
+
+ GLFramebuffer fbo;
+ glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_CUBE_MAP_POSITIVE_X,
+ cube, 0);
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT1, GL_TEXTURE_CUBE_MAP_NEGATIVE_X,
+ cube, 0);
+ constexpr GLenum kDrawBufs[2] = {GL_COLOR_ATTACHMENT0, GL_COLOR_ATTACHMENT1};
+ glDrawBuffers(2, kDrawBufs);
+ ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER);
+ ASSERT_GL_NO_ERROR();
+
+ // Draw once to flush all dirty bits.
+ drawQuad(program, essl31_shaders::PositionAttrib(), 0.5f);
+
+ // Bind the texture as a storage image. This can trigger a recreation of the backing image of
+ // the texture.
+ glBindImageTexture(0, cube, 0, GL_FALSE, 0, GL_READ_WRITE, GL_RGBA8);
+ ASSERT_GL_NO_ERROR();
+
+ // Change one of the attachments to dirty it, but not the other one.
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_CUBE_MAP_POSITIVE_Y,
+ cube, 0);
+
+ // Draw again. If the backing image is recreated, both framebuffer attachments must be updated.
+ drawQuad(program, essl31_shaders::PositionAttrib(), 0.5f);
+ glReadBuffer(GL_COLOR_ATTACHMENT0);
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
+ glReadBuffer(GL_COLOR_ATTACHMENT1);
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::green);
+
+ // Verify the first draw was also done correctly
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_CUBE_MAP_POSITIVE_X,
+ cube, 0);
+ glReadBuffer(GL_COLOR_ATTACHMENT0);
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
+}
+
+// Verify that recreating a texture's backing image due to srgb override works when a framebuffer is
+// attached to multiple faces of the same cubemap.
+TEST_P(FramebufferTest_ES31, AttachToMultipleCubeFacesThenSrgbOverride)
+{
+ ANGLE_SKIP_TEST_IF(!IsGLExtensionEnabled("GL_EXT_texture_format_sRGB_override"));
+
+ constexpr char kFS[] = R"(#version 310 es
+precision mediump float;
+layout(location = 0) out vec4 o0;
+layout(location = 1) out vec4 o1;
+void main()
+{
+ o0 = vec4(1.0, 0.0, 0.0, 1.0);
+ o1 = vec4(0.0, 1.0, 0.0, 1.0);
+})";
+ ANGLE_GL_PROGRAM(program, essl31_shaders::vs::Simple(), kFS);
+ glUseProgram(program);
+
+ // Create a cube map, and attach a framebuffer to two faces of it.
+ GLTexture cube;
+ glBindTexture(GL_TEXTURE_CUBE_MAP, cube);
+ glTexStorage2D(GL_TEXTURE_CUBE_MAP, 1, GL_RGBA8, 6, 6);
+ ASSERT_GL_NO_ERROR();
+
+ GLFramebuffer fbo;
+ glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_CUBE_MAP_POSITIVE_X,
+ cube, 0);
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT1, GL_TEXTURE_CUBE_MAP_NEGATIVE_X,
+ cube, 0);
+ constexpr GLenum kDrawBufs[2] = {GL_COLOR_ATTACHMENT0, GL_COLOR_ATTACHMENT1};
+ glDrawBuffers(2, kDrawBufs);
+ ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER);
+ ASSERT_GL_NO_ERROR();
+
+ // Draw once to flush all dirty bits.
+ drawQuad(program, essl31_shaders::PositionAttrib(), 0.5f);
+
+ // Enable SRGB override on the texture
+ glTexParameteri(GL_TEXTURE_CUBE_MAP, GL_TEXTURE_FORMAT_SRGB_OVERRIDE_EXT, GL_SRGB);
+ ASSERT_GL_NO_ERROR();
+
+ // Change one of the attachments to dirty it, but not the other one.
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_CUBE_MAP_POSITIVE_Y,
+ cube, 0);
+
+ // Draw again. If the backing image is recreated, both framebuffer attachments must be updated.
+ drawQuad(program, essl31_shaders::PositionAttrib(), 0.5f);
+ glReadBuffer(GL_COLOR_ATTACHMENT0);
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
+ glReadBuffer(GL_COLOR_ATTACHMENT1);
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::green);
+
+ // Verify the first draw was also done correctly
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_CUBE_MAP_POSITIVE_X,
+ cube, 0);
+ glReadBuffer(GL_COLOR_ATTACHMENT0);
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
+}
+
+// Verify that recreating a texture's backing image due to MSRTT binding works when a framebuffer is
+// attached to multiple faces of the same cubemap.
+TEST_P(FramebufferTest_ES31, AttachToMultipleCubeFacesThenMSRTT)
+{
+ ANGLE_SKIP_TEST_IF(!EnsureGLExtensionEnabled("GL_EXT_multisampled_render_to_texture"));
+
+ constexpr char kFS[] = R"(#version 310 es
+precision mediump float;
+layout(location = 0) out vec4 o0;
+layout(location = 1) out vec4 o1;
+void main()
+{
+ o0 = vec4(1.0, 0.0, 0.0, 1.0);
+ o1 = vec4(0.0, 1.0, 0.0, 1.0);
+})";
+ ANGLE_GL_PROGRAM(program, essl31_shaders::vs::Simple(), kFS);
+ glUseProgram(program);
+
+ // Create a cube map, and attach a framebuffer to two faces of it.
+ GLTexture cube;
+ glBindTexture(GL_TEXTURE_CUBE_MAP, cube);
+ glTexStorage2D(GL_TEXTURE_CUBE_MAP, 1, GL_RGBA8, 6, 6);
+ ASSERT_GL_NO_ERROR();
+
+ GLFramebuffer fbo;
+ glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_CUBE_MAP_POSITIVE_X,
+ cube, 0);
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT1, GL_TEXTURE_CUBE_MAP_NEGATIVE_X,
+ cube, 0);
+ constexpr GLenum kDrawBufs[2] = {GL_COLOR_ATTACHMENT0, GL_COLOR_ATTACHMENT1};
+ glDrawBuffers(2, kDrawBufs);
+ ASSERT_GL_FRAMEBUFFER_COMPLETE(GL_FRAMEBUFFER);
+ ASSERT_GL_NO_ERROR();
+
+ // Draw once to flush all dirty bits.
+ drawQuad(program, essl31_shaders::PositionAttrib(), 0.5f);
+
+ // Bind the texture to an unrelated MSRTT framebuffer.
+ GLFramebuffer msrtt;
+ glBindFramebuffer(GL_READ_FRAMEBUFFER, msrtt);
+ glFramebufferTexture2DMultisampleEXT(GL_READ_FRAMEBUFFER, GL_COLOR_ATTACHMENT0,
+ GL_TEXTURE_CUBE_MAP_NEGATIVE_Z, cube, 0, 4);
+ EXPECT_GL_FRAMEBUFFER_COMPLETE(GL_READ_FRAMEBUFFER);
+ glBindFramebuffer(GL_READ_FRAMEBUFFER, fbo);
+ ASSERT_GL_NO_ERROR();
+
+ // Change one of the attachments to dirty it, but not the other one.
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_CUBE_MAP_POSITIVE_Y,
+ cube, 0);
+
+ // Draw again. If the backing image is recreated, both framebuffer attachments must be updated.
+ drawQuad(program, essl31_shaders::PositionAttrib(), 0.5f);
+ glReadBuffer(GL_COLOR_ATTACHMENT0);
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
+ glReadBuffer(GL_COLOR_ATTACHMENT1);
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::green);
+
+ // Verify the first draw was also done correctly
+ glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_CUBE_MAP_POSITIVE_X,
+ cube, 0);
+ glReadBuffer(GL_COLOR_ATTACHMENT0);
+ EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
+}
+
+// Verify that recreating a texture's backing image due to changing its base level works when a
+// framebuffer is attached to multiple faces of the same cubemap.
+TEST_P(FramebufferTest_ES31, AttachToMultipleCubeFacesThenChangeBaseLevel)
+{
+ constexpr char kFS[] = R"(#version 310 es
+precision mediump float;
+layout(location = 0) out vec4 o0;
+layout(location = 1) out vec4 o1;
+void main()
+{
+ o0 = vec4(1.0, 0.0, 0.0, 1.0);
+ o1 = vec4(0.0, 1.0, 0.0, 1.0);
+})";
+ ANGLE_GL_PROGRAM(program, essl31_shaders::vs::Simple(), kFS);
+ glUseProgram(program);
+
+ // Create a cube map with multiple levels, and attach a framebuffer to two faces of it.
+ // The [base, max] level is initially [3, 4] and the framebuffer is attached to level 4. Later,
... (truncated)
Loading diff…
Original Bug Report
reported by vm...@google.com
Potential Use-After-Free in ANGLE Vulkan FramebufferVk State Sync
Project Fortify, an experimental security project, has identified the following potential security issue.
Overview: A potential use-after-free exists in ANGLE’s Vulkan backend during framebuffer state synchronization. When a texture attached to multiple color slots undergoes storage respecification, it destroys all associated RenderTargetVk objects, but re-entrant dirty bit notifications are ignored by the active sync loop. This leaves dangling raw pointers in the framebuffer’s render target cache that are subsequently dereferenced, potentially allowing RCE in the GPU process.
Affected files:
third_party/angle/src/libANGLE/renderer/vulkan/FramebufferVk.cppthird_party/angle/src/libANGLE/renderer/vulkan/TextureVk.cppthird_party/angle/src/libANGLE/Framebuffer.cppthird_party/angle/src/libANGLE/Texture.cppthird_party/angle/src/libANGLE/renderer/RenderTargetCache.h
Estimated timestamp from git blame: 2026-01-30
Description
A potential Use-After-Free (UAF) vulnerability exists in ANGLE’s Vulkan backend related to how gl::Framebuffer synchronizes state with FramebufferVk. The issue occurs when a single texture is bound to multiple framebuffer color attachments, and a state change triggers an image storage respecification.
When gl::Framebuffer::syncState is called, it takes a snapshot of the current dirty bits (mDirtyBitsGuard = mDirtyBits;) and passes this to the Vulkan backend. FramebufferVk::syncState iterates over this snapshot using a BitSetIterator.
If processing a dirty attachment (e.g., GL_COLOR_ATTACHMENT0) requires the underlying texture to respecify its image storage (e.g., via TextureVk::respecifyImageStorageIfNecessary), the texture destroys its existing Vulkan image and clears all cached RenderTargetVk objects by calling releaseImageViews. This frees the memory for all render targets associated with this texture, including those bound to other attachments (e.g., GL_COLOR_ATTACHMENT1).
The texture broadcasts a SubjectChanged notification regarding this recreation. gl::Framebuffer receives this and re-entrantly sets the dirty bit for the other affected attachments (DIRTY_BIT_COLOR_BUFFER_CONTENTS_1). However, because FramebufferVk::syncState is iterating over a by-value snapshot of the dirty bits, it ignores this newly set bit and fails to update the render target cache for attachment 1.
After the sync loop completes, FramebufferVk::syncState calls updateColorAttachmentColorspace and later startNewRenderPass. Both of these methods iterate over all active color attachments and dereference the raw RenderTargetVk* pointers stored in mRenderTargetCache. For attachment 1, this pointer is now dangling, resulting in a use-after-free.
Finally, when mImpl->syncState returns, gl::Framebuffer::syncState unconditionally executes mDirtyBits.reset(), permanently discarding the re-entrant notification and cementing the stale cache.
Potential Trigger Steps
Note: These are suggested steps based on static code analysis; our tooling agent does not currently have the capability to execute a working proof-of-concept.
- Create a 2D Array Texture or 3D Texture with multiple layers.
- Create a Framebuffer and attach layer 0 to
GL_COLOR_ATTACHMENT0and layer 1 toGL_COLOR_ATTACHMENT1. - Issue a draw call to populate the backend
RenderTargetCachewith validRenderTargetVkpointers. - Bind the texture to an image unit (e.g.,
glBindImageTexture(0, texture, ...)). This flags the texture to requireVK_IMAGE_USAGE_STORAGE_BITbut does not trigger a state notification. - Re-bind layer 0 to
GL_COLOR_ATTACHMENT0to dirty only the first attachment in the framebuffer’smDirtyBits. - Issue a second draw call.
FramebufferVk::syncStatewill process attachment 0, trigger the storage respecification (freeing attachment 1’sRenderTargetVk), ignore the re-entrant dirty bit for attachment 1, and subsequently dereference the freed pointer for attachment 1.
Exploitability
The RenderTargetVk objects are stored as raw pointers within RenderTargetCache and are not protected by MiraclePtr (BRP) within the ANGLE component. An attacker with the ability to manipulate heap allocations in the GPU process could reclaim the freed RenderTargetVk memory. By forging internal pointers (such as vk::ImageHelper*), the attacker can hijack virtual method calls (e.g., image->hasSubresourceDefinedContent()) triggered during startNewRenderPass, potentially achieving Remote Code Execution (RCE) in the sandboxed GPU process.
Proposed Fix
- Do not unconditionally discard re-entrant dirty bits: In
gl::Framebuffer::syncState, instead of unconditionally callingmDirtyBits.reset(), the code should clear only the bits that were actually processed (e.g.,mDirtyBits &= ~mDirtyBitsGuard;), or loop untilmDirtyBits.none()is true to ensure re-entrant updates are handled before drawing. - Safe Caching:
RenderTargetCacheshould ideally not rely on raw pointers. Using weak pointers or an observer pattern to explicitly nullify cached render targets when their underlying storage is destroyed would prevent the dangling pointer dereference entirely.
Evaluated with Chrome root at commit: a9cbf6e8b275fe4147435aa905f3b7f5a656f5f0
Results from so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.
References
On This Page