glsl: Don't crash on function names with invalid identifiers.

Karol Herbst's fuzzing efforts noticed that we would segfault on:

   void bug() {
      2(0);
   }

We just need to bail if the function name isn't an identifier.

Based on a bug fix by Karol Herbst.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97422
Signed-off-by: Kenneth Graunke <kenneth@whitecape.org>
Reviewed-by: Timothy Arceri <timothy.arceri@collabora.com>
This commit is contained in:
Kenneth Graunke
2016-11-12 11:55:30 -08:00
parent 9c676a6427
commit 151aecabe4

View File

@@ -2090,7 +2090,7 @@ ast_function_expression::hir(exec_list *instructions,
return handle_method(instructions, state);
} else {
const ast_expression *id = subexpressions[0];
const char *func_name;
const char *func_name = NULL;
YYLTYPE loc = get_location();
exec_list actual_parameters;
ir_variable *sub_var = NULL;
@@ -2104,8 +2104,10 @@ ast_function_expression::hir(exec_list *instructions,
id->subexpressions[0],
id->subexpressions[1], &func_name,
&actual_parameters);
} else {
} else if (id->oper == ast_identifier) {
func_name = id->primary_expression.identifier;
} else {
_mesa_glsl_error(&loc, state, "function name is not an identifier");
}
/* an error was emitted earlier */