Skip to content

zero-init instance_layer_list in EnumerateInstanceLayerProperties - #2004

Merged
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:enum-instance-layers-init-list
Aug 9, 2026
Merged

zero-init instance_layer_list in EnumerateInstanceLayerProperties#2004
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:enum-instance-layers-init-list

Conversation

@aizu-m

@aizu-m aizu-m commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Found this comparing the two instance-property terminators.

terminator_EnumerateInstanceLayerProperties, on the parse_layer_environment_var_filters error path:

loader.c:7659  struct loader_layer_list instance_layer_list;   // uninitialised
loader.c:7664  result = parse_layer_environment_var_filters(NULL, &layer_filters);
               if (result != VK_SUCCESS) goto out;             // reaches cleanup before the memset

parse_layer_environment_var_filters returns VK_ERROR_OUT_OF_HOST_MEMORY when it cannot allocate the lowercased copy of VK_LOADER_LAYERS_ENABLE / VK_LAYERS_DISABLE / VK_LOADER_LAYERS_ALLOW. That copy is sized by the env var value and inst is NULL here, so it is a plain calloc. The memset that clears instance_layer_list sits after that call, so the early goto out reaches the out: cleanup with the struct still holding stack garbage. loader_delete_layer_list_and_properties then walks count entries, calling loader_platform_close_library(list[i].lib_handle) and freeing every string in each element, then frees list, all from indeterminate values.

The sibling terminator_EnumerateInstanceExtensionProperties memsets its list before the same call. This one had the order reversed. Zero-initialise at the declaration so the cleanup is a no-op when the parse fails.

@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

1 similar comment
@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

@charles-lunarg
charles-lunarg merged commit ff6f71a into KhronosGroup:main Aug 9, 2026
51 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants