Skip to content

Fix null pointer dereference in DependencyInfoDumpingHandler#1546

Open
YLChen-007 wants to merge 1 commit intogoogle:mainfrom
YLChen-007:fix/null-deref-dependency-info
Open

Fix null pointer dereference in DependencyInfoDumpingHandler#1546
YLChen-007 wants to merge 1 commit intogoogle:mainfrom
YLChen-007:fix/null-deref-dependency-info

Conversation

@YLChen-007
Copy link
Copy Markdown

Description

This PR fixes a null pointer dereference vulnerability (SIGSEGV) in DependencyInfoDumpingHandler::DumpDependencyInfo() that occurs when glslc is invoked with the -MD flag, and the resulting dependency info output file cannot be opened for writing.

Root Cause

When attempting to generate the .d dependency file in a read-only directory, a non-existent path, or when the disk is full, the utility function shaderc_util::GetOutputStream() correctly logs an error and returns nullptr.

However, in glslc/src/dependency_info.cc, the stream pointer dep_file_stream was dereferenced unconditionally without a null check:

*dep_file_stream << dep_string_stream.str();

This resulted in an immediate segmentation fault (SIGSEGV) and a process crash.

Fix

Added a standard null check to verify dep_file_stream before writing to it. If it is null, the handler gracefully returns false. This aligns perfectly with the identical mitigation pattern previously established in glslc/src/file_compiler.cc (e.g. Commit 1d9790184b2e8fb726719deac80caaf6374daed7).

Testing

We have reproduced the crash locally and verified that with this patch, glslc now correctly exits with a graceful error output (exit code 1) instead of crashing when facing unwritable output dependency paths.

@google-cla
Copy link
Copy Markdown

google-cla bot commented Apr 11, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Copy link
Copy Markdown
Collaborator

@dneto0 dneto0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The logic looks ok.

Please add a test to https://github.com/google/shaderc/blob/main/glslc/test/option_dash_M.py

Also, please sign the CLA. I can't accept the changes without the CLA.

Add a null check for the return value of GetOutputStream() in
dependency_info.cc before dereferencing the stream pointer. When
GetOutputStream() fails to open the output file (e.g., due to
permission errors, full disk, or non-existent directory), it returns
nullptr. The code previously unconditionally dereferenced this pointer,
causing a segmentation fault (SIGSEGV).

This is the same vulnerability pattern that was fixed in
file_compiler.cc (commit 1d97901), but was missed in the
dependency_info.cc code path. The fix follows the identical pattern:
check the pointer for null before use and return false on failure.

Bug: Null pointer dereference when glslc is invoked with -MD flag
and the dependency info output file cannot be opened for writing.
@YLChen-007 YLChen-007 force-pushed the fix/null-deref-dependency-info branch from 7cd2913 to bfdab44 Compare April 13, 2026 07:56
Copy link
Copy Markdown
Collaborator

@dneto0 dneto0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@dneto0 dneto0 enabled auto-merge (rebase) April 13, 2026 08:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants