loader: clamp driver-reported device extension count to caller buffer

[aizu-m]

ASan, calling vkEnumerateDeviceExtensionProperties with app-supplied storage against a driver that over-reports the number of extensions it wrote:

READ of size 1 in compare_vk_extension_properties (loader.c:734)
  has_vk_extension_property_array (loader.c:741)
  terminator_EnumerateDeviceExtensionProperties (loader.c:7469)

Found while going over the driver-count paths in loader.c. On the branch where the app passes its own pProperties, the caller's *pPropertyCount is handed to the driver as the buffer size, and the count the driver writes back (written_count) is then used as the element count for the has_vk_extension_property_array dedup scan over pProperties while merging in implicit-layer device extensions. written_count is never bounded back to the storage that was given, so a driver returning VK_SUCCESS with a larger count walks the scan off the end of the caller's buffer. The *pPropertyCount <= written_count check lower down only covers the memcpy append, and it runs after the read.

Clamp written_count to the caller-supplied count right after the driver call. A conformant driver returning VK_SUCCESS never writes more than the capacity it was handed, so this is a no-op for them.

The regression test drives a driver reporting 64 entries into a one-element buffer with an implicit layer present. It trips ASan before the change and passes after.

[ci-tester-lunarg]

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

[ci-tester-lunarg]

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

[ci-tester-lunarg]

CI Vulkan-Loader build queued with queue ID 93351.

[ci-tester-lunarg]

CI Vulkan-Loader build # 3728 running.

[ci-tester-lunarg]

CI Vulkan-Loader build # 3728 passed.