Fix null pointer dereference in DependencyInfoDumpingHandler#1546
Open
YLChen-007 wants to merge 1 commit intogoogle:mainfrom
Open
Fix null pointer dereference in DependencyInfoDumpingHandler#1546YLChen-007 wants to merge 1 commit intogoogle:mainfrom
YLChen-007 wants to merge 1 commit intogoogle:mainfrom
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
dneto0
requested changes
Apr 13, 2026
Collaborator
dneto0
left a comment
There was a problem hiding this comment.
The logic looks ok.
Please add a test to https://github.com/google/shaderc/blob/main/glslc/test/option_dash_M.py
Also, please sign the CLA. I can't accept the changes without the CLA.
Add a null check for the return value of GetOutputStream() in dependency_info.cc before dereferencing the stream pointer. When GetOutputStream() fails to open the output file (e.g., due to permission errors, full disk, or non-existent directory), it returns nullptr. The code previously unconditionally dereferenced this pointer, causing a segmentation fault (SIGSEGV). This is the same vulnerability pattern that was fixed in file_compiler.cc (commit 1d97901), but was missed in the dependency_info.cc code path. The fix follows the identical pattern: check the pointer for null before use and return false on failure. Bug: Null pointer dereference when glslc is invoked with -MD flag and the dependency info output file cannot be opened for writing.
7cd2913 to
bfdab44
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes a null pointer dereference vulnerability (SIGSEGV) in
DependencyInfoDumpingHandler::DumpDependencyInfo()that occurs whenglslcis invoked with the-MDflag, and the resulting dependency info output file cannot be opened for writing.Root Cause
When attempting to generate the
.ddependency file in a read-only directory, a non-existent path, or when the disk is full, the utility functionshaderc_util::GetOutputStream()correctly logs an error and returnsnullptr.However, in
glslc/src/dependency_info.cc, the stream pointerdep_file_streamwas dereferenced unconditionally without a null check:This resulted in an immediate segmentation fault (SIGSEGV) and a process crash.
Fix
Added a standard null check to verify
dep_file_streambefore writing to it. If it is null, the handler gracefully returnsfalse. This aligns perfectly with the identical mitigation pattern previously established inglslc/src/file_compiler.cc(e.g. Commit1d9790184b2e8fb726719deac80caaf6374daed7).Testing
We have reproduced the crash locally and verified that with this patch,
glslcnow correctly exits with a graceful error output (exit code 1) instead of crashing when facing unwritable output dependency paths.