{"action":"created","issue":{"url":"https://api.github.com/repos/KhronosGroup/Vulkan-LoaderAndValidationLayers/issues/164","repository_url":"https://api.github.com/repos/KhronosGroup/Vulkan-LoaderAndValidationLayers","labels_url":"https://api.github.com/repos/KhronosGroup/Vulkan-LoaderAndValidationLayers/issues/164/labels{/name}","comments_url":"https://api.github.com/repos/KhronosGroup/Vulkan-LoaderAndValidationLayers/issues/164/comments","events_url":"https://api.github.com/repos/KhronosGroup/Vulkan-LoaderAndValidationLayers/issues/164/events","html_url":"https://github.com/KhronosGroup/Vulkan-LoaderAndValidationLayers/issues/164","id":142560894,"number":164,"title":"loader_unexpand_inst_layer_names writes through const pointer","user":{"login":"Ralith","id":104558,"avatar_url":"https://avatars.githubusercontent.com/u/104558?v=3","gravatar_id":"","url":"https://api.github.com/users/Ralith","html_url":"https://github.com/Ralith","followers_url":"https://api.github.com/users/Ralith/followers","following_url":"https://api.github.com/users/Ralith/following{/other_user}","gists_url":"https://api.github.com/users/Ralith/gists{/gist_id}","starred_url":"https://api.github.com/users/Ralith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Ralith/subscriptions","organizations_url":"https://api.github.com/users/Ralith/orgs","repos_url":"https://api.github.com/users/Ralith/repos","events_url":"https://api.github.com/users/Ralith/events{/privacy}","received_events_url":"https://api.github.com/users/Ralith/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/KhronosGroup/Vulkan-LoaderAndValidationLayers/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"jeremy-lunarg","id":6943397,"avatar_url":"https://avatars.githubusercontent.com/u/6943397?v=3","gravatar_id":"","url":"https://api.github.com/users/jeremy-lunarg","html_url":"https://github.com/jeremy-lunarg","followers_url":"https://api.github.com/users/jeremy-lunarg/followers","following_url":"https://api.github.com/users/jeremy-lunarg/following{/other_user}","gists_url":"https://api.github.com/users/jeremy-lunarg/gists{/gist_id}","starred_url":"https://api.github.com/users/jeremy-lunarg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeremy-lunarg/subscriptions","organizations_url":"https://api.github.com/users/jeremy-lunarg/orgs","repos_url":"https://api.github.com/users/jeremy-lunarg/repos","events_url":"https://api.github.com/users/jeremy-lunarg/events{/privacy}","received_events_url":"https://api.github.com/users/jeremy-lunarg/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/KhronosGroup/Vulkan-LoaderAndValidationLayers/milestones/1","html_url":"https://github.com/KhronosGroup/Vulkan-LoaderAndValidationLayers/milestones/P1","labels_url":"https://api.github.com/repos/KhronosGroup/Vulkan-LoaderAndValidationLayers/milestones/1/labels","id":1616525,"number":1,"title":"P1","description":"","creator":{"login":"lentinem","id":9709345,"avatar_url":"https://avatars.githubusercontent.com/u/9709345?v=3","gravatar_id":"","url":"https://api.github.com/users/lentinem","html_url":"https://github.com/lentinem","followers_url":"https://api.github.com/users/lentinem/followers","following_url":"https://api.github.com/users/lentinem/following{/other_user}","gists_url":"https://api.github.com/users/lentinem/gists{/gist_id}","starred_url":"https://api.github.com/users/lentinem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lentinem/subscriptions","organizations_url":"https://api.github.com/users/lentinem/orgs","repos_url":"https://api.github.com/users/lentinem/repos","events_url":"https://api.github.com/users/lentinem/events{/privacy}","received_events_url":"https://api.github.com/users/lentinem/received_events","type":"User","site_admin":false},"open_issues":14,"closed_issues":41,"state":"open","created_at":"2016-03-01T21:57:16Z","updated_at":"2016-04-05T14:59:11Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2016-03-22T06:34:30Z","updated_at":"2016-04-06T08:59:34Z","closed_at":null,"body":"During calls to `vkCreateInstance` and `vkCreateDevice`, `loader_unexpand_inst_layer_names` writes to the array passed in through the `const char* const* ppEnabledLayerNames` members of the respective CreateInfo structs. Although the written value seems to be exactly what was already there, when read-only memory is passed in ppEnabledLayerNames as the type permits, undefined behavior results. In my environment this consistently crashes my program in the loader.\r\n\r\nThe write occurs on loader.c:1749 in the assignment to *pp_str in this loop:\r\n```C\r\n    for (uint32_t i = 0; i < layer_count; i++) {\r\n        char **pp_str = (char **)&pCreateInfo->ppEnabledLayerNames[i];\r\n        *pp_str = layer_names[i];\r\n    }\r\n```\r\n\r\nThe following program consistently reproduces the crash:\r\n```C\r\n#include <vulkan/vulkan.h>\r\n\r\nint main(int argc, char** argv) {\r\n  const char* const layers[] = {\r\n    \"VK_LAYER_LUNARG_param_checker\"\r\n  };\r\n\r\n  VkInstance instance;\r\n  VkInstanceCreateInfo info;\r\n  info.sType = VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO;\r\n  info.pNext = NULL;\r\n  info.flags = 0;\r\n  info.pApplicationInfo = NULL;\r\n  info.enabledLayerCount = 1;\r\n  info.ppEnabledLayerNames = layers;\r\n  info.enabledExtensionCount = 0;\r\n  info.ppEnabledExtensionNames = NULL;\r\n  vkCreateInstance(&info, NULL, &instance);\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/KhronosGroup/Vulkan-LoaderAndValidationLayers/issues/comments/206235798","html_url":"https://github.com/KhronosGroup/Vulkan-LoaderAndValidationLayers/issues/164#issuecomment-206235798","issue_url":"https://api.github.com/repos/KhronosGroup/Vulkan-LoaderAndValidationLayers/issues/164","id":206235798,"user":{"login":"chrisforbes","id":128877,"avatar_url":"https://avatars.githubusercontent.com/u/128877?v=3","gravatar_id":"","url":"https://api.github.com/users/chrisforbes","html_url":"https://github.com/chrisforbes","followers_url":"https://api.github.com/users/chrisforbes/followers","following_url":"https://api.github.com/users/chrisforbes/following{/other_user}","gists_url":"https://api.github.com/users/chrisforbes/gists{/gist_id}","starred_url":"https://api.github.com/users/chrisforbes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chrisforbes/subscriptions","organizations_url":"https://api.github.com/users/chrisforbes/orgs","repos_url":"https://api.github.com/users/chrisforbes/repos","events_url":"https://api.github.com/users/chrisforbes/events{/privacy}","received_events_url":"https://api.github.com/users/chrisforbes/received_events","type":"User","site_admin":false},"created_at":"2016-04-06T08:59:34Z","updated_at":"2016-04-06T08:59:34Z","body":"@jon-lunarg @jeremy-lunarg this (and related badness) is addressed by #274"}}