Re:Khronos Releases OpenGL 4.3 Specification with Major Enha...
by malkia on Monday August 06, 2012 @05:21PM
(#4347342)
Well for example an uint32_t index buffer - it might contain indices that are outside of what's allowed. If the kernel/driver verifies this everytime, it might slow down somehow the operation. It's totally possible that the driver/chip somehow "clips" this, or being a bit of undefined operation - simply ignores it.
There might be other cases too.
Re:Khronos Releases OpenGL 4.3 Specification with Major Enha...
by cscheid on Monday August 06, 2012 @11:26PM
(#4348549)
WebGL mandates that the user agent check indices: http://www.khronos.org/registry/webgl/specs/latest/#ATTRIBS_...
As I alluded above, the current WebGL spec is actually fairly well-designed with respect to trying to crash display drivers.
The word "undefined" actually only appears once in the current spec, in a bit about canvas drawing buffers being preserved across frames. And, in fact, in that case it mandates implementations to clear the buffer before any WebGL call can read the contents to prevent leakage.
Most of the claims of WebGL security issues are either to old versions of the spec (which leaked data to shaders and led to things like timing attacks) or are currently a bit on the hyperbolic side.
The security aspects of the interaction between GPU code and HTML clients are all well-addressed by the current WebGL spec. Which particular concerns are you talking about?
One possibility where the new OpenGL 4.3 requirements might help is in current desktop WebGL implementations which translate WebGL (which is OpenGL ES) to OpenGL (the desktop). But WebGL is sometimes translated to OpenGL, sometimes to Direct3D via ANGLE, sometimes to OpenGL ES directly. Finally, relatively few desktop drivers actually implement the latest OpenGL spec anyway; OS X does not even have OpenGL 4.2 yet, despite being out for a long while now.
All this is to say that 1) I don't believe the new requirements will have no immediate impact on WebGL security and 2) WebGL buffer security is a non-issue (whether WebGL clients crash the video drivers or not is a different story).