Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Crash]: CopyDParam causes stack-buffer-overflow #11922

Closed
TrueBrain opened this issue Jan 29, 2024 · 2 comments · Fixed by #11952
Closed

[Crash]: CopyDParam causes stack-buffer-overflow #11922

TrueBrain opened this issue Jan 29, 2024 · 2 comments · Fixed by #11952
Labels
bug Something isn't working

Comments

@TrueBrain
Copy link
Member

Version of OpenTTD

90084dc, Linux

Steps to reproduce

Run OpenTTD compiled with an address sanitizer enabled.
Load in a few NewGRFs

Generate lot of errors .. it will happen .. sometimes. Not always.

Doesn't only happen with ErrorWindow, but with any other CopyDParam it can. This is just the easiest to use for that.

Upload crash files

==52789==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffe9e977608 at pc 0x5637330c67d6 bp 0x7ffe9e976da0 sp 0x7ffe9e976568
READ of size 3 at 0x7ffe9e977608 thread T0
    #0 0x5637330c67d5 in __interceptor_strlen (/home/micro/projects/OpenTTD/OpenTTD/build-clang/openttd+0x149d7d5) (BuildId: b7b0ff4a64b9e84cd7d79bda87d27c0e535d6ba6)
    #1 0x563733174e94 in std::char_traits<char>::length(char const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/char_traits.h:399:9
    #2 0x5637334ccd84 in std::basic_string_view<char, std::char_traits<char> >::basic_string_view(char const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/string_view:134:16
    #3 0x56373541fbfd in CopyOutDParam(std::vector<StringParameterBackup, std::allocator<StringParameterBackup> >&, unsigned long) /home/micro/projects/OpenTTD/OpenTTD/src/strings.cpp:182:16
    #4 0x5637347ba6f4 in ErrorMessageData::CopyOutDParams() /home/micro/projects/OpenTTD/OpenTTD/src/error_gui.cpp:126:2
    #5 0x5637347bb3d1 in ShowErrorMessage(unsigned int, unsigned int, WarningLevel, int, int, GRFFile const*, unsigned int, unsigned int const*, unsigned int) /home/micro/projects/OpenTTD/OpenTTD/src/error_gui.cpp:435:7
    #6 0x5637347bae14 in ShowErrorMessage(unsigned int, int, int, CommandCost) /home/micro/projects/OpenTTD/OpenTTD/src/error_gui.cpp:389:2
@glx22
Copy link
Contributor

glx22 commented Jan 29, 2024

I happens when SetDParamStr() was used for a previous string, and the pointer is no longer valid.

@PeterN
Copy link
Member

PeterN commented Jan 29, 2024

"I have a patch for that" somewhere.

JGRennison added a commit to JGRennison/OpenTTD-patches that referenced this issue Jan 30, 2024
@TrueBrain TrueBrain added the bug Something isn't working label Feb 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants