# Reproducing the ANGLE D3D11 VertexDataManager offset truncation OOB read

This issue was tested on Chromium commit `cdd1f63c02` on Windows 10 x64 with an ASAN build. The bug requires the D3D11 ANGLE backend, so it applies only to Windows.

Because the vulnerable code path in the GPU process is guarded by two renderer-side range checks that reject offsets above INT_MAX, reproducing the bug requires simulating a compromised renderer. The attached `patch.diff` removes the upper-bound check from `GLES2Implementation::ValidateOffset` in the GPU command buffer client and from `WebGLRenderingContextBase::ValidateValueFitNonNegInt32` in the Blink WebGL layer. Both functions reside in the renderer process, so modifying them is consistent with the compromised-renderer threat model. No GPU-process code is changed.

To begin, check out the tested revision and apply the patch.

```
cd D:\chromium\src
git checkout cdd1f63c02
git apply patch.diff
```

Configure an ASAN build by creating `out/asan-release/args.gn` with the following content.

```
is_asan = true
is_debug = false
is_component_build = true
symbol_level = 1
dcheck_always_on = false
```

Then build Chrome.

```
autoninja -C out/asan-release chrome
```

Launch Chrome and open the PoC.

```
set ASAN_OPTIONS=detect_odr_violation=0
out\asan-release\chrome.exe --enable-logging=stderr --no-first-run --no-default-browser-check --user-data-dir=%TEMP%\poc file:///D:/chromium/src/poc.html
```

The GPU process will print an AddressSanitizer heap-buffer-overflow report to stderr and abort. The browser process will log "GPU process exited unexpectedly." The expected ASAN summary line is:

```
SUMMARY: AddressSanitizer: heap-buffer-overflow copyvertex.inc.h:102
  in rx::CopyNativeVertexData<signed char,3,4,127>
```

After reproducing, restore the tree with `git checkout -- .` to undo the renderer patch.