Merge pull request KhronosGroup#2656 from ShabbyX/fix-oob

Fix OOB write in matrix constructor
qingyuanzNV · Jun 4, 2021 · 2675cc3 · 2675cc3
2 parents de2cb9d + cfdeeb8
commit 2675cc3
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/SPIRV/SpvBuilder.cpp b/SPIRV/SpvBuilder.cpp
@@ -2543,7 +2543,7 @@ Id Builder::createMatrixConstructor(Decoration precision, const std::vector<Id>&
         int row = 0;
         int col = 0;
 
-        for (int arg = 0; arg < (int)sources.size(); ++arg) {
+        for (int arg = 0; arg < (int)sources.size() && col < numCols; ++arg) {
             Id argComp = sources[arg];
             for (int comp = 0; comp < getNumComponents(sources[arg]); ++comp) {
                 if (getNumComponents(sources[arg]) > 1) {
@@ -2555,6 +2555,10 @@ Id Builder::createMatrixConstructor(Decoration precision, const std::vector<Id>&
                     row = 0;
                     col++;
                 }
+                if (col == numCols) {
+                    // If more components are provided than fit the matrix, discard the rest.
+                    break;
+                }
             }
         }
     }