commit 8f633ef2b5f72872d89445fc3ce3981f0e49756d
author John Stiles <johnstiles@google.com> Sat Aug 21 17:13:11 2021 -0400
committer SkCQ <skcq-be@skia-corp.google.com.iam.gserviceaccount.com> Mon Aug 23 14:23:46 2021 +0000
tree d2ba3798e3dc84f6a0eec85b10c998159ff60b87
parent e312532442d152d0f4049559884488f021852ff7

Fix assertion discovered by fuzzer.

We now stop processing a var-declaration if its array-size expression is
invalid. Previously, we'd pass a null array-size expression into
convertVar, which would assert (but would fail cleanly afterwards).

Change-Id: I976f3326e32afbc7045a86d73c0dcb28f418a6f4
Bug: oss-fuzz:37457
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/441079
Auto-Submit: John Stiles <johnstiles@google.com>
Commit-Queue: Brian Osman <brianosman@google.com>
Reviewed-by: Brian Osman <brianosman@google.com>

gn/sksl_tests.gni

diff --git a/gn/sksl_tests.gni b/gn/sksl_tests.gni
index 2c29eab..1aefe93 100644
--- a/gn/sksl_tests.gni
+++ b/gn/sksl_tests.gni
@@ -96,6 +96,7 @@
   "/sksl/errors/Ossfuzz32156.sksl",
   "/sksl/errors/Ossfuzz32587.sksl",
   "/sksl/errors/Ossfuzz32851.sksl",
+  "/sksl/errors/Ossfuzz37457.sksl",
   "/sksl/errors/OverflowFloatLiteral.sksl",
   "/sksl/errors/OverflowIntLiteral.sksl",
   "/sksl/errors/OverflowInt64Literal.sksl",

resources/sksl/errors/Ossfuzz37457.sksl

diff --git a/resources/sksl/errors/Ossfuzz37457.sksl b/resources/sksl/errors/Ossfuzz37457.sksl
new file mode 100644
index 0000000..0cdfdaf
--- /dev/null
+++ b/resources/sksl/errors/Ossfuzz37457.sksl
@@ -0,0 +1 @@
+float a[b];

src/sksl/SkSLIRGenerator.cpp

diff --git a/src/sksl/SkSLIRGenerator.cpp b/src/sksl/SkSLIRGenerator.cpp
index e82e9c0..c4eeb8c 100644
--- a/src/sksl/SkSLIRGenerator.cpp
+++ b/src/sksl/SkSLIRGenerator.cpp
@@ -411,12 +411,14 @@
         std::unique_ptr<Expression> value;
         auto iter = varDecl.begin();
         if (iter != varDecl.end() && varData.fIsArray) {
-            if (*iter) {
-                arraySize = this->convertExpression(*iter++);
-            } else {
+            if (!*iter) {
                 this->errorReporter().error(decls.fOffset, "array must have a size");
                 continue;
             }
+            arraySize = this->convertExpression(*iter++);
+            if (!arraySize) {
+                continue;
+            }
         }
         if (iter != varDecl.end()) {
             value = this->convertExpression(*iter);

tests/sksl/errors/Ossfuzz37457.glsl

diff --git a/tests/sksl/errors/Ossfuzz37457.glsl b/tests/sksl/errors/Ossfuzz37457.glsl
new file mode 100644
index 0000000..053c502
--- /dev/null
+++ b/tests/sksl/errors/Ossfuzz37457.glsl
@@ -0,0 +1,4 @@
+### Compilation failed:
+
+error: 1: unknown identifier 'b'
+1 error