diff --git a/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp b/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp index c23d424b1a..1b44b70d37 100644 --- a/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp +++ b/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp @@ -23,6 +23,20 @@ #include "libANGLE/renderer/vulkan/vk_renderer.h" #include "libANGLE/renderer/vulkan/vk_resource.h" +// POC instrumentation: pull in ASAN manual-poisoning interface so that the +// suballocation boundary inside a shared VkDeviceMemory block is visible to +// ASAN. Without this, the OOB read in StreamVertexDataWithDivisor lands inside +// the same malloc()ed BufferBlock and ASAN cannot detect it. +#if defined(__has_feature) +# if __has_feature(address_sanitizer) +# include +# endif +#endif +#if !defined(ASAN_POISON_MEMORY_REGION) +# define ASAN_POISON_MEMORY_REGION(addr, size) ((void)(addr), (void)(size)) +# define ASAN_UNPOISON_MEMORY_REGION(addr, size) ((void)(addr), (void)(size)) +#endif + namespace rx { namespace @@ -1450,10 +1464,22 @@ angle::Result VertexArrayVk::updateStreamedAttribs(const gl::Context *context, size_t numVertices = GetVertexCount(bufferVk, binding, srcAttributeSize); + // --- POC instrumentation: make the suballocation boundary visible + // to ASAN. The OOB read lands inside the same VkDeviceMemory mapping + // (a large BufferBlock under SwiftShader's malloc), so ASAN cannot + // detect it without explicit poisoning. This does NOT change program + // behaviour; it only marks bytes past the GL buffer's logical end. + size_t __poc_avail = + static_cast(bufferGL->getSize()) - binding.getOffset(); + constexpr size_t __poc_guard = 256; + ASAN_POISON_MEMORY_REGION(src + __poc_avail, __poc_guard); + ANGLE_TRY(StreamVertexDataWithDivisor( contextVk, vertexDataBuffer, src, bytesToAllocate, binding.getStride(), stride, vertexFormat.getVertexLoadFunction(), divisor, numVertices)); + ASAN_UNPOISON_MEMORY_REGION(src + __poc_avail, __poc_guard); + ANGLE_TRY(bufferVk->unmapReadAccessOnly(contextVk)); } else if (contextVk->getExtensions().robustnessAny())