loader: Fix buffer overflow in loader_add_to_dev_ext_list
authorGabríel Arthúr Pétursson <gabriel@system.is>
Sat, 3 Jun 2017 01:38:49 +0000 (01:38 +0000)
committerLenny Komow <lenny@lunarg.com>
Mon, 5 Jun 2017 15:25:57 +0000 (09:25 -0600)
The size argument to a call to memcpy is for the wrong struct. The type
of `ext->list[idx].props` is VkExtensionProperties.

Credit goes to AddressSanitizer for spotting this bug.

loader/loader.c

index f5c74a3..cd249cb 100644 (file)
@@ -910,7 +910,7 @@ VkResult loader_add_to_dev_ext_list(const struct loader_instance *inst, struct l
         ext_list->capacity *= 2;
     }
 
-    memcpy(&ext_list->list[idx].props, props, sizeof(struct loader_dev_ext_props));
+    memcpy(&ext_list->list[idx].props, props, sizeof(*props));
     ext_list->list[idx].entrypoint_count = entry_count;
     ext_list->list[idx].entrypoints =
         loader_instance_heap_alloc(inst, sizeof(char *) * entry_count, VK_SYSTEM_ALLOCATION_SCOPE_INSTANCE);