Skip to content

null-terminate device name copies in linux device sort#1941

Open
aizu-m wants to merge 1 commit into
KhronosGroup:mainfrom
aizu-m:linux-sort-device-name-nul-term
Open

null-terminate device name copies in linux device sort#1941
aizu-m wants to merge 1 commit into
KhronosGroup:mainfrom
aizu-m:linux-sort-device-name-nul-term

Conversation

@aizu-m

@aizu-m aizu-m commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

ASan, with a driver that fills all 256 bytes of deviceName and no terminator:

READ of size 257 ... heap-buffer-overflow
#0 printf_common
#2 linux_read_sorted_physical_devices loader_linux.c

Was reading through the physical-device sort path. The loader copies the driver-reported deviceName into its own LinuxSortedDeviceInfo with strncpy bounded by the full VK_MAX_PHYSICAL_DEVICE_NAME_SIZE. strncpy leaves no terminator when the source occupies the whole field, so a driver that returns a 256-byte name produces an unterminated device_name. That field is then logged with %s, so the read runs off the end of the buffer, past the heap allocation for the last sorted entry.

We make our own copy here, so the termination has to be guaranteed on our side rather than trusted from the driver. The same copy is in linux_sort_physical_device_groups. Both now bound the copy to SIZE-1 and write the terminator, matching the strncpy plus explicit nul already used in loader_windows.c.

@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

1 similar comment
@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants