Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed reading freed memory when AiPlayer->UnitTypeBuilt is reallocated. #13

Merged
merged 1 commit into from
May 28, 2015

Conversation

Szunti
Copy link
Contributor

@Szunti Szunti commented May 28, 2015

Fixing first invalid read error reported by valgrind in #12.

The valgrind error:

==22938== Invalid read of size 4
==22938==    at 0x486471: AiCheckingWork (ai_resource.cpp:882)
==22938==    by 0x486471: AiResourceManager() (ai_resource.cpp:1535)
==22938==    by 0x47D342: AiEachSecond(CPlayer&) (ai.cpp:1058)
==22938==    by 0x4F1216: PlayersEachSecond(int) (player.cpp:1304)
==22938==    by 0x4EE2FA: GameLogicLoop (mainloop.cpp:300)
==22938==    by 0x4EE2FA: SingleGameLoop (mainloop.cpp:390)
==22938==    by 0x4EE2FA: GameMainLoop() (mainloop.cpp:427)
==22938==    by 0x49980E: StartMap(std::string const&, bool) (game.cpp:164)
==22938==    by 0x5A459E: tolua_stratagus_StartMap00(lua_State*) (tolua.cpp:1063)
==22938==    by 0x4E421E7: ??? (in /usr/lib/liblua5.1.so.5.1.5)
==22938==    by 0x4E4C92E: ??? (in /usr/lib/liblua5.1.so.5.1.5)
==22938==    by 0x4E4262C: ??? (in /usr/lib/liblua5.1.so.5.1.5)
==22938==    by 0x4E4191A: ??? (in /usr/lib/liblua5.1.so.5.1.5)
==22938==    by 0x4E427B9: ??? (in /usr/lib/liblua5.1.so.5.1.5)
==22938==    by 0x4E3E57C: lua_pcall (in /usr/lib/liblua5.1.so.5.1.5)
==22938==  Address 0xebe02d4 is 4 bytes inside a block of size 64 free'd
==22938==    at 0x4C2B6D0: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==22938==    by 0x486F53: deallocate (new_allocator.h:110)
==22938==    by 0x486F53: deallocate (alloc_traits.h:386)
==22938==    by 0x486F53: _M_deallocate (stl_vector.h:178)
==22938==    by 0x486F53: void std::vector<AiBuildQueue, std::allocator<AiBuildQueue> >::_M_insert_aux<AiBuildQueue const&>(__gnu_cxx::__normal_iterator<AiBuildQueue*, std::vector<AiBuildQueue, std::allocator<AiBuildQueue> > >, AiBuildQueue const&) (vector.tcc:394)
==22938==    by 0x4859F3: insert (vector.tcc:131)
==22938==    by 0x4859F3: AiRequestSupply() (ai_resource.cpp:575)
==22938==    by 0x486886: AiCheckingWork (ai_resource.cpp:879)
==22938==    by 0x486886: AiResourceManager() (ai_resource.cpp:1535)
==22938==    by 0x47D342: AiEachSecond(CPlayer&) (ai.cpp:1058)
==22938==    by 0x4F1216: PlayersEachSecond(int) (player.cpp:1304)
==22938==    by 0x4EE2FA: GameLogicLoop (mainloop.cpp:300)
==22938==    by 0x4EE2FA: SingleGameLoop (mainloop.cpp:390)
==22938==    by 0x4EE2FA: GameMainLoop() (mainloop.cpp:427)
==22938==    by 0x49980E: StartMap(std::string const&, bool) (game.cpp:164)
==22938==    by 0x5A459E: tolua_stratagus_StartMap00(lua_State*) (tolua.cpp:1063)
==22938==    by 0x4E421E7: ??? (in /usr/lib/liblua5.1.so.5.1.5)
==22938==    by 0x4E4C92E: ??? (in /usr/lib/liblua5.1.so.5.1.5)
==22938==    by 0x4E4262C: ??? (in /usr/lib/liblua5.1.so.5.1.5)

First half tells where the read happened. Second half tells what valgrind knew of the memory (it was freed at the place with the backtrace given). Then it was easy to see that the insert could make a reallocation when the container reached the allocated size, but queue was pointing to the old place.

Andrettin added a commit that referenced this pull request May 28, 2015
Fixed reading freed memory when AiPlayer->UnitTypeBuilt is reallocated.
@Andrettin Andrettin merged commit d7a68f4 into Andrettin:master May 28, 2015
@Andrettin
Copy link
Owner

Thanks a lot!

@Andrettin Andrettin mentioned this pull request Jul 14, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants