Closed ghost closed 5 years ago
Hey, thanks! A couple of initial comments:
In the template, there are some variables that appear to not be used anywhere, e.g. vertexShader3/4 fragmentShader3/4. At the same time, the grammar seems to use sh1 and sh2 and I don't see where these are declared. Are these supposed to be related?
There is some duplication in the grammar that appears unnecessary, for example:
gl1.pixelStorei(<Glenum>, <glint>);
gl2.pixelStorei(<Glenum>, <glint>);
can be written as
<gl>.pixelStorei(<Glenum>, <glint>);
with
<gl> = gl1
<gl> = gl2
declared somewhere earlier. This pattern is present at many places in the grammar. I realize it might be more difficult to resolve in cases the params depend on which gl object is used, but for many functions this does not appear the case.
I don't know a lot about WebGL, but people who tried fuzzing it earlier told me they had problems with context getting lost on most errors and then all subsequent lines failing. I'm wondering if this is something you encountered and if you have some way of dealing with this (not saying that you should, just mention this as a discussion point).
hi, i did this some time ago, and figured people might want to use this. i'll apply changes to this pr according to your comment.
i'd be surprised if i know more than anyone about gl but i didn't encounter this problem. personally i found a uaf, at the time, but had problems reproducing the crash. take this as an example: https://bugs.chromium.org/p/chromium/issues/detail?id=848914 (this was obviously fuzzed)
anyway.. i'll apply the change's and comment here again.
well.. i hope this makes more sense...
Looks good to me now, thanks! Also interesting to know the background and about the other bug.
well, what can be done more is to add a syntax for the shaders and fuzz them as well. i can do that once i'll have the time. ty for sharing your useful tools.
regards
That would be awesome :-)
looks like some have taken this to the next level =)
this commit adds a WebGL dictionary, generator and template...
i signed the cla.
regards