When running the attached test case, you'll often see a crash on a bad write, perhaps looking a little like this (Linux x64):

Program received signal SIGSEGV, Segmentation fault.
0x00007fad007f731b in ?? ()
=> 0x00007fad007f731b:	mov    %eax,0x10(%rdx,%rcx,4)
rax            0x41414141	1094795585
rdx            0x7facfe38a048	140380976226376
rcx            0x2faf085	50000005

The attacker actually controls the value being written (eax) and the bad out-of-bounds index (rcx).

The cause is that ShaderParameter resolution has a bug. Each ShaderParameter patches the shader bytecode in order to set an input parameter value. Unfortunately, if a ShaderParameter from a longer program is associated with a ShaderData for a shorter program, the patch-up location goes out-of-bounds relative to the short program.


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

 

ShaderParameterSwitcheroo.swf 995 bytes Download

ShaderParameterSwitcheroo.as 2.4 KB Download