Skip to content

heap overflow when appending oversized manifest paths#1919

Open
jmestwa-coder wants to merge 1 commit into
KhronosGroup:mainfrom
jmestwa-coder:manifest-heap-overflow
Open

heap overflow when appending oversized manifest paths#1919
jmestwa-coder wants to merge 1 commit into
KhronosGroup:mainfrom
jmestwa-coder:manifest-heap-overflow

Conversation

@jmestwa-coder
Copy link
Copy Markdown

Summary

Fix a heap buffer overflow in windows_add_json_entry() when processing oversized manifest paths discovered through registry or D3DKMT enumeration.

Root Cause

  • The initial allocation path always used the existing buffer size, regardless of the incoming manifest path length.
  • The growth path expanded the buffer by at most a single doubling, which could still leave the destination undersized for large values.
  • Appended writes were bounded by the source length instead of the remaining destination capacity.

Together, these conditions could result in writes beyond the allocated buffer when handling oversized manifest paths.

Changes

  • Size the destination buffer based on the required length before writing.
  • Grow the buffer until the incoming value fits.
  • Return VK_ERROR_OUT_OF_HOST_MEMORY when the required size cannot be represented.
  • Bound all writes using the destination buffer capacity.

@ci-tester-lunarg
Copy link
Copy Markdown

Author jmestwa-coder not on autobuild list. Waiting for curator authorization before starting CI build.

1 similar comment
@ci-tester-lunarg
Copy link
Copy Markdown

Author jmestwa-coder not on autobuild list. Waiting for curator authorization before starting CI build.

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Jun 5, 2026

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants