From 39c05a902fda50bb0b281333e7581e5b10308032 Mon Sep 17 00:00:00 2001
From: Antonio Maiorano <amaiorano@google.com>
Date: Tue, 1 Jun 2021 00:37:40 +0000
Subject: [PATCH] Resolver: validate vector swizzle index is valid

Bug: tint:217
Change-Id: Ie8988b68f43914d1b05d982c8aa6f8b7346e2d8f
Reviewed-on: https://dawn-review.googlesource.com/c/tint/+/52800
Kokoro: Kokoro <noreply+kokoro@google.com>
Commit-Queue: Antonio Maiorano <amaiorano@google.com>
Reviewed-by: David Neto <dneto@google.com>
---
 src/resolver/resolver.cc        |  6 ++++++
 src/resolver/resolver_test.cc   |  2 +-
 src/resolver/validation_test.cc | 14 +++++++++++++-
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/src/resolver/resolver.cc b/src/resolver/resolver.cc
index 99dc700b8b..3f9a9dac46 100644
--- a/src/resolver/resolver.cc
+++ b/src/resolver/resolver.cc
@@ -1983,6 +1983,12 @@ bool Resolver::MemberAccessor(ast::MemberAccessorExpression* expr) {
               expr->member()->source().Begin() + swizzle.size());
           return false;
       }
+
+      if (swizzle.back() >= vec->size()) {
+        diagnostics_.add_error("invalid vector swizzle member",
+                               expr->member()->source());
+        return false;
+      }
     }
 
     if (size < 1 || size > 4) {
diff --git a/src/resolver/resolver_test.cc b/src/resolver/resolver_test.cc
index e4c777a31b..aa7169240f 100644
--- a/src/resolver/resolver_test.cc
+++ b/src/resolver/resolver_test.cc
@@ -1115,7 +1115,7 @@ TEST_F(ResolverTest, Expr_MemberAccessor_Struct_Alias) {
 }
 
 TEST_F(ResolverTest, Expr_MemberAccessor_VectorSwizzle) {
-  Global("my_vec", ty.vec3<f32>(), ast::StorageClass::kInput);
+  Global("my_vec", ty.vec4<f32>(), ast::StorageClass::kInput);
 
   auto* mem = MemberAccessor("my_vec", "xzyw");
   WrapInFunction(mem);
diff --git a/src/resolver/validation_test.cc b/src/resolver/validation_test.cc
index 4b9731c7d9..f5933fc21b 100644
--- a/src/resolver/validation_test.cc
+++ b/src/resolver/validation_test.cc
@@ -389,7 +389,7 @@ TEST_F(ResolverValidationTest, Expr_MemberAccessor_VectorSwizzle_BadChar) {
 }
 
 TEST_F(ResolverValidationTest, Expr_MemberAccessor_VectorSwizzle_MixedChars) {
-  Global("my_vec", ty.vec3<f32>(), ast::StorageClass::kInput);
+  Global("my_vec", ty.vec4<f32>(), ast::StorageClass::kInput);
 
   auto* ident = create<ast::IdentifierExpression>(
       Source{{Source::Location{3, 3}, Source::Location{3, 7}}},
@@ -417,6 +417,18 @@ TEST_F(ResolverValidationTest, Expr_MemberAccessor_VectorSwizzle_BadLength) {
   EXPECT_EQ(r()->error(), "3:3 error: invalid vector swizzle size");
 }
 
+TEST_F(ResolverValidationTest, Expr_MemberAccessor_VectorSwizzle_BadIndex) {
+  Global("my_vec", ty.vec2<f32>(), ast::StorageClass::kInput);
+
+  auto* ident = create<ast::IdentifierExpression>(Source{{3, 3}},
+                                                  Symbols().Register("z"));
+  auto* mem = MemberAccessor("my_vec", ident);
+  WrapInFunction(mem);
+
+  EXPECT_FALSE(r()->Resolve());
+  EXPECT_EQ(r()->error(), "3:3 error: invalid vector swizzle member");
+}
+
 TEST_F(ResolverValidationTest,
        Stmt_Loop_ContinueInLoopBodyBeforeDecl_UsageInContinuing) {
   // loop  {