765161 - WebGL crash when empty string is passed to getUniformLocation, getAttribLocation or bindAttribLocation [@mozilla::WebGLProgram::MapIdentifier] (dupe)

Status: RESOLVED DUPLICATE of bug 765179

(Core :: Graphics: CanvasWebGL, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

Have only marked this as a sec bug because asan said heap overflow. 

The second parameter for getUniformLocation() is causing a crash which is an empty string.

getUniformLocation(pg, '');

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Comment 3

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: check for empty variable names

This should fix it, although i am running in Valgrind at the moment to confirm.

Doing it in ValidateGLSLVariableName() allows to fix this bug also in other functions all at once.

Comment 4

[Benoit Jacob [:bjacob] (mostly away)]

No valgrind errors with this patch.

Comment 5

[Benoit Jacob [:bjacob] (mostly away)]

Comment on attachment 633541 [details] [diff] [review]
check for empty variable names

We ended up doing the reviews on the other bug, sorry.

Comment 7

[Christian Holler (:decoder)]

Original bug is open now, so we can open this too.