Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Project crash when using PackedByteArray.compress #36611

Closed
qarmin opened this issue Feb 27, 2020 · 1 comment · Fixed by #39100
Closed

Project crash when using PackedByteArray.compress #36611

qarmin opened this issue Feb 27, 2020 · 1 comment · Fixed by #39100

Comments

@qarmin
Copy link
Contributor

qarmin commented Feb 27, 2020

Godot version:
4.0.dev.custom_build. ed0f194

OS/device including version:
Ubuntu 19.10

Issue description:
Invalid read from Address Sanitizer(later cause crash)

==16673==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d000681154 at pc 0x000001810264 bp 0x7ffefdac85c0 sp 0x7ffefdac85b0
READ of size 4 at 0x60d000681154 thread T0
    #0 0x1810263 in CowData<unsigned char>::size() const core/cowdata.h:128
    #1 0x191f621 in Vector<unsigned char>::size() const core/vector.h:84
    #2 0xfa5fdb1 in _VariantCall::_call_PackedByteArray_compress(Variant&, Variant&, Variant const**) core/variant_call.cpp:624
    #3 0xfa25704 in _VariantCall::FuncData::call(Variant&, Variant&, Variant const**, int, Callable::CallError&) core/variant_call.cpp:121
    #4 0xf9370d9 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Callable::CallError&) core/variant_call.cpp:1235
    #5 0x41098bb in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1102
    #6 0x3f6a251 in GDScriptInstance::call(StringName const&, Variant const**, int, Callable::CallError&) modules/gdscript/gdscript.cpp:1305
    #7 0xf65992d in Object::call(StringName const&, Variant const**, int, Callable::CallError&) core/object.cpp:883
    #8 0xf936df7 in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Callable::CallError&) core/variant_call.cpp:1222
    #9 0x41098bb in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Callable::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1102
    #10 0x3f6a76a in GDScriptInstance::call_multilevel(StringName const&, Variant const**, int) modules/gdscript/gdscript.cpp:1321
    #11 0xa116359 in Node::_notification(int) scene/main/node.cpp:63
    #12 0x1927d39 in Node::_notificationv(int, bool) scene/main/node.h:46
    #13 0x192a1e3 in CanvasItem::_notificationv(int, bool) scene/2d/canvas_item.h:166
    #14 0xba47fa3 in Node2D::_notificationv(int, bool) scene/2d/node_2d.h:38
    #15 0xf65a252 in Object::notification(int, bool) core/object.cpp:913
    #16 0xa234b87 in SceneTree::_notify_group_pause(StringName const&, int) scene/main/scene_tree.cpp:988
    #17 0xa224db2 in SceneTree::idle(float) scene/main/scene_tree.cpp:527
    #18 0x17bb12e in Main::iteration() main/main.cpp:2062
    #19 0x16c5a60 in OS_X11::run() platform/x11/os_x11.cpp:3321
    #20 0x1641889 in main platform/x11/godot_x11.cpp:56
    #21 0x7fadc3a5d1e2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x271e2)
    #22 0x164149d in _start (/usr/bin/godots+0x164149d)

0x60d000681154 is located 4 bytes inside of 144-byte region [0x60d000681150,0x60d0006811e0)
freed by thread T0 here:
    #0 0x7fadc4ce36ef in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d6ef)
    #1 0xfc50995 in Memory::free_static(void*, bool) core/os/memory.cpp:178
    #2 0x164229c in CowData<wchar_t>::_unref(void*) core/cowdata.h:213
    #3 0x1641e56 in CowData<wchar_t>::~CowData() core/cowdata.h:370
    #4 0x1641ca9 in String::~String() core/ustring.h:126
    #5 0x100e45c2 in ResourceLoader::load(String const&, String const&, bool, Error*) core/io/resource_loader.cpp:350
    #6 0xce0ae44 in ResourceInteractiveLoaderText::_parse_ext_resource(VariantParser::Stream*, Ref<Resource>&, int&, String&) scene/resources/resource_format_text.cpp:172
    #7 0xce6d293 in ResourceInteractiveLoaderText::_parse_ext_resources(void*, VariantParser::Stream*, Ref<Resource>&, int&, String&) scene/resources/resource_format_text.h:77
    #8 0xfb44423 in VariantParser::parse_value(VariantParser::Token&, Variant&, VariantParser::Stream*, int&, String&, VariantParser::ResourceParser*) core/variant_parser.cpp:880
    #9 0xfb4dd34 in VariantParser::parse_tag_assign_eof(VariantParser::Stream*, int&, String&, VariantParser::Tag&, String&, Variant&, VariantParser::ResourceParser*, bool) core/variant_parser.cpp:1449
    #10 0xce0f4c8 in ResourceInteractiveLoaderText::_parse_node_tag(VariantParser::ResourceParser&) scene/resources/resource_format_text.cpp:274
    #11 0xce28271 in ResourceInteractiveLoaderText::poll() scene/resources/resource_format_text.cpp:629
    #12 0x100db6ee in ResourceFormatLoader::load(String const&, String const&, Error*) core/io/resource_loader.cpp:197
    #13 0x100e10d2 in ResourceLoader::_load(String const&, String const&, String const&, bool, Error*) core/io/resource_loader.cpp:270
    #14 0x100e3d8a in ResourceLoader::load(String const&, String const&, bool, Error*) core/io/resource_loader.cpp:401
    #15 0x17b395e in Main::start() main/main.cpp:1892
    #16 0x16417b9 in main platform/x11/godot_x11.cpp:55
    #17 0x7fadc3a5d1e2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x271e2)

previously allocated by thread T0 here:
    #0 0x7fadc4ce3f1e in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10df1e)
    #1 0xfc5051f in Memory::realloc_static(void*, unsigned long, bool) core/os/memory.cpp:137
    #2 0x2d86f6e in CowData<wchar_t>::resize(int) core/cowdata.h:283
    #3 0x6c5cd79 in String::resize(int) core/ustring.h:154
    #4 0xf871919 in String::operator+=(String const&) core/ustring.cpp:283
    #5 0xf8715cc in String::operator+(String const&) const core/ustring.cpp:259
    #6 0xf893047 in String::simplify_path() const core/ustring.cpp:3314
    #7 0xf6bef27 in ProjectSettings::localize_path(String const&) const core/project_settings.cpp:65
    #8 0x100e2fd8 in ResourceLoader::load(String const&, String const&, bool, Error*) core/io/resource_loader.cpp:354
    #9 0xce0ae44 in ResourceInteractiveLoaderText::_parse_ext_resource(VariantParser::Stream*, Ref<Resource>&, int&, String&) scene/resources/resource_format_text.cpp:172
    #10 0xce6d293 in ResourceInteractiveLoaderText::_parse_ext_resources(void*, VariantParser::Stream*, Ref<Resource>&, int&, String&) scene/resources/resource_format_text.h:77
    #11 0xfb44423 in VariantParser::parse_value(VariantParser::Token&, Variant&, VariantParser::Stream*, int&, String&, VariantParser::ResourceParser*) core/variant_parser.cpp:880
    #12 0xfb4dd34 in VariantParser::parse_tag_assign_eof(VariantParser::Stream*, int&, String&, VariantParser::Tag&, String&, Variant&, VariantParser::ResourceParser*, bool) core/variant_parser.cpp:1449
    #13 0xce0f4c8 in ResourceInteractiveLoaderText::_parse_node_tag(VariantParser::ResourceParser&) scene/resources/resource_format_text.cpp:274
    #14 0xce28271 in ResourceInteractiveLoaderText::poll() scene/resources/resource_format_text.cpp:629
    #15 0x100db6ee in ResourceFormatLoader::load(String const&, String const&, Error*) core/io/resource_loader.cpp:197
    #16 0x100e10d2 in ResourceLoader::_load(String const&, String const&, String const&, bool, Error*) core/io/resource_loader.cpp:270
    #17 0x100e3d8a in ResourceLoader::load(String const&, String const&, bool, Error*) core/io/resource_loader.cpp:401
    #18 0x17b395e in Main::start() main/main.cpp:1892
    #19 0x16417b9 in main platform/x11/godot_x11.cpp:55
    #20 0x7fadc3a5d1e2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x271e2)

SUMMARY: AddressSanitizer: heap-use-after-free core/cowdata.h:128 in CowData<unsigned char>::size() const

Steps to reproduce:

Minimal reproduction project:
QQQQ.zip

@qarmin
Copy link
Contributor Author

qarmin commented Jun 29, 2020

Probably will be fixed by #39100
New minimal project import.zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants