Fix UBSan error in spirv-dis fuzzer (#4517)
Pending a more general solution for constructing a target environment
based on the bytes of a test input, this change avoids a UBSan error
caused by the existing approach.
Fixes https://crbug.com/38087
diff --git a/test/fuzzers/spvtools_dis_fuzzer.cpp b/test/fuzzers/spvtools_dis_fuzzer.cpp
index ca9a52d..5a72722 100644
--- a/test/fuzzers/spvtools_dis_fuzzer.cpp
+++ b/test/fuzzers/spvtools_dis_fuzzer.cpp
@@ -22,13 +22,24 @@
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
if (size < sizeof(spv_target_env) + 1) return 0;
- const spv_context context =
- spvContextCreate(*reinterpret_cast<const spv_target_env*>(data));
+ // TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/4450): A more
+ // general solution to choosing the target environment based on the input
+ // buffer should ultimately be used.
+ uint32_t first_data_word = *reinterpret_cast<const uint32_t*>(data);
+ spv_target_env target_env = static_cast<spv_target_env>(
+ first_data_word % (static_cast<uint32_t>(SPV_ENV_VULKAN_1_2) + 1));
+ const spv_context context = spvContextCreate(target_env);
if (context == nullptr) return 0;
data += sizeof(spv_target_env);
size -= sizeof(spv_target_env);
+ if (size < 4) {
+ // There are not enough bytes to constitute a binary that can be
+ // disassembled.
+ return 0;
+ }
+
std::vector<uint32_t> input;
input.resize(size >> 2);
size_t count = 0;
