commit 4002e92a89780c515b6f8c2b1574501f39a19b39
author Olli Etuaho <oetuaho@nvidia.com> Wed Apr 04 16:55:34 2018 +0300
committer Commit Bot <commit-bot@chromium.org> Thu Apr 05 17:07:27 2018 +0000
tree 69c48e0b56cf02a6e896f24a89e7659747973a84
parent dd196e0bc0c4d291c09a4f48e7b7da3cc53eeecf

Guard traversers used during parsing against stack overflow

Traversers used during parsing can be vulnerable to stack overflow
since the AST has not yet been validated for max depth. Make sure to
check for traversal depth in traversers used during parsing.

We set the maximum traversal depth in ValidateGlobalInitializer and
ValidateSwitchStatementList to 256, which matches the default value
for validating general AST complexity. The depth check is on
regardless of compiler options. In case the traversers go over the
maximum traversal depth, they fail validation.

BUG=angleproject:2453
TEST=angle_unittests

Change-Id: I89ba576e8ef69663ba35d7b9050a6da319f1757c
Reviewed-on: https://chromium-review.googlesource.com/995795
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Olli Etuaho <oetuaho@nvidia.com>

src/compiler/translator/OutputGLSLBase.cpp

diff --git a/src/compiler/translator/OutputGLSLBase.cpp b/src/compiler/translator/OutputGLSLBase.cpp
index e780f40..553d6c1 100644
--- a/src/compiler/translator/OutputGLSLBase.cpp
+++ b/src/compiler/translator/OutputGLSLBase.cpp
@@ -846,7 +846,7 @@
 {
     TInfoSinkBase &out = objSink();
     // Scope the blocks except when at the global scope.
-    if (mDepth > 0)
+    if (getCurrentTraversalDepth() > 0)
     {
         out << "{\n";
     }
@@ -863,7 +863,7 @@
     }
 
     // Scope the blocks except when at the global scope.
-    if (mDepth > 0)
+    if (getCurrentTraversalDepth() > 0)
     {
         out << "}\n";
     }