layers: Validate specialization entry data is fully contained within the specialization data block.

Signed-off-by: Chris Forbes <chrisforbes@google.com>

3 files changed, 36 insertions, 0 deletions

diff --git a/layers/draw_state.cpp b/layers/draw_state.cpp
index c9c4b221..40f6df76 100644
--- a/layers/draw_state.cpp
+++ b/layers/draw_state.cpp
@@ -1349,6 +1349,38 @@ static bool verify_set_layout_compatibility(layer_data* my_data, const SET_NODE*
     return true;
 }
 
+
+// Validate that data for each specialization entry is fully contained within the buffer.
+static VkBool32
+validate_specialization_offsets(layer_data *my_data, VkPipelineShaderStageCreateInfo const *info)
+{
+    VkBool32 pass = VK_TRUE;
+
+    VkSpecializationInfo const *spec = info->pSpecializationInfo;
+
+    if (spec) {
+        for (auto i = 0u; i < spec->mapEntryCount; i++) {
+            if (spec->pMapEntries[i].offset + spec->pMapEntries[i].size > spec->dataSize) {
+                if (log_msg(my_data->report_data, VK_DEBUG_REPORT_ERROR_BIT_EXT, VK_DEBUG_REPORT_OBJECT_TYPE_DEVICE_EXT,
+                    /*dev*/0, __LINE__, SHADER_CHECKER_BAD_SPECIALIZATION, "SC",
+                    "Specialization entry %u (for constant id %u) references memory outside provided "
+                    "specialization data (bytes %u.."
+                    PRINTF_SIZE_T_SPECIFIER "; " PRINTF_SIZE_T_SPECIFIER " bytes provided)",
+                    i, spec->pMapEntries[i].constantID,
+                    spec->pMapEntries[i].offset,
+                    spec->pMapEntries[i].offset + spec->pMapEntries[i].size - 1,
+                    spec->dataSize)) {
+
+                    pass = VK_FALSE;
+                }
+            }
+        }
+    }
+
+    return pass;
+}
+
+
 // Validate that the shaders used by the given pipeline
 //  As a side effect this function also records the sets that are actually used by the pipeline
 static VkBool32
@@ -1378,6 +1410,8 @@ validate_pipeline_shaders(layer_data *my_data, VkDevice dev, PIPELINE_NODE* pPip
                 }
             }
             else {
+                pass = validate_specialization_offsets(my_data, pStage) && pass;
+
                 shader_module *module = my_data->shaderModuleMap[pStage->module];
                 shaders[get_shader_stage_id(pStage->stage)] = module;
 
diff --git a/layers/draw_state.h b/layers/draw_state.h
index d1c01d64..0d10e1ef 100755
--- a/layers/draw_state.h
+++ b/layers/draw_state.h
@@ -207,6 +207,7 @@ typedef enum _SHADER_CHECKER_ERROR {
     SHADER_CHECKER_UNKNOWN_STAGE,           /* Stage is not supported by analysis */
     SHADER_CHECKER_INCONSISTENT_VI,         /* VI state contains conflicting binding or attrib descriptions */
     SHADER_CHECKER_MISSING_DESCRIPTOR,      /* Shader attempts to use a descriptor binding not declared in the layout */
+    SHADER_CHECKER_BAD_SPECIALIZATION,      /* Specialization map entry points outside specialization data block */
 } SHADER_CHECKER_ERROR;
 
 typedef enum _DRAW_TYPE
diff --git a/layers/vk_validation_layer_details.md b/layers/vk_validation_layer_details.md
index 072e0979..adbded53 100644
--- a/layers/vk_validation_layer_details.md
+++ b/layers/vk_validation_layer_details.md
@@ -127,6 +127,7 @@ depends on the pair of pipeline stages involved.
 | FS mixed broadcast | Flag error if the fragment shader writes both the legacy gl_FragCoord (which broadcasts to all CBs) and custom FS outputs. | FS_MIXED_BROADCAST | vkCreateGraphicsPipelines | TODO | Reference compiler refuses to compile shaders which do this |
 | VI Binding Descriptions | Validate that there is a single vertex input binding description for each binding | INCONSISTENT_VI | vkCreateGraphicsPipelines | CreatePipelineAttribBindingConflict | NA |
 | Shader Stage Check | Warns if shader stage is unsupported | UNKNOWN_STAGE | vkCreateGraphicsPipelines | TBD | NA |
+| Shader Specialization | Error if specialization entry data is not fully contained within the specialization data block. | BAD_SPECIALIZATION | vkCreateGraphicsPipelines vkCreateComputePipelines | TBD | NA |
 | Missing Descriptor | Flags error if shader attempts to use a descriptor binding not declared in the layout | MISSING_DESCRIPTOR | vkCreateGraphicsPipelines | CreatePipelineUniformBlockNotProvided | NA |
 | NA | Enum used for informational messages | NONE | | NA | None |