fix(core): validate bounds of pass timestamp writes' indices

Author: ErichDonGubler

CHANGELOG.md

@@ -133,6 +133,7 @@ By @ErichDonGubler in [#6456](https://github.com/gfx-rs/wgpu/pull/6456), [#6148]
 - Replace potentially unsound usage of `PreHashedMap` with `FastHashMap`. By @jamienicol in [#6541](https://github.com/gfx-rs/wgpu/pull/6541).
 - Add missing validation for timestamp writes in compute and render passes. By @ErichDonGubler in [#6578](https://github.com/gfx-rs/wgpu/pull/6578).
   - Check the status of the `TIMESTAMP_QUERY` feature before other validation.
+  - Check that indices are in-bounds for the query set.
 
 #### Naga
 

wgpu-core/src/command/compute.rs

@@ -335,6 +335,16 @@ impl Global {
                 Err(e) => return make_err(e.into(), arc_desc),
             }
 
+            for idx in [beginning_of_pass_write_index, end_of_pass_write_index]
+                .into_iter()
+                .flatten()
+            {
+                match query_set.validate_query(SimplifiedQueryType::Timestamp, idx, None) {
+                    Ok(()) => (),
+                    Err(e) => return make_err(e.into(), arc_desc),
+                }
+            }
+
             Some(ArcPassTimestampWrites {
                 query_set,
                 beginning_of_pass_write_index,

wgpu-core/src/command/mod.rs

@@ -654,6 +654,8 @@ pub enum CommandEncoderError {
     InvalidResource(#[from] InvalidResourceError),
     #[error(transparent)]
     MissingFeatures(#[from] MissingFeatures),
+    #[error(transparent)]
+    TimestampWritesInvalid(#[from] QueryUseError),
 }
 
 impl Global {

wgpu-core/src/command/query.rs

@@ -160,7 +160,7 @@ pub enum ResolveError {
 }
 
 impl QuerySet {
-    fn validate_query(
+    pub(crate) fn validate_query(
         self: &Arc<Self>,
         query_type: SimplifiedQueryType,
         query_index: u32,

wgpu-core/src/command/render.rs

@@ -1,6 +1,7 @@
 use crate::binding_model::BindGroup;
 use crate::command::{
     validate_and_begin_occlusion_query, validate_and_begin_pipeline_statistics_query,
+    SimplifiedQueryType,
 };
 use crate::init_tracker::BufferInitTrackerAction;
 use crate::pipeline::RenderPipeline;
@@ -1404,6 +1405,13 @@ impl Global {
 
                 query_set.same_device(device)?;
 
+                for idx in [beginning_of_pass_write_index, end_of_pass_write_index]
+                    .into_iter()
+                    .flatten()
+                {
+                    query_set.validate_query(SimplifiedQueryType::Timestamp, idx, None)?;
+                }
+
                 Some(ArcPassTimestampWrites {
                     query_set,
                     beginning_of_pass_write_index,