[??-g20b6395cf]Use after free with HUDMessages and DoomRPG
Posted: Wed Jun 19, 2019 3:08 pm
by Edward-san
Yes, it's the same bug as here, as apparently not everything is fixed. I managed to make gzdoom crash again with a more recent build. See this report from the address sanitizer:
Spoiler:How to reproduce this (happens by trial and error): load the same save file from the other bug report, then bind two keys to 'mdk' and 'summon cyberdemon', then press the key for 'mdk', then after a few moments (like half a second) press the key for 'summon cyberdemon', then again, after a few moments, 'mdk' and repeat. It will crash in a way or in another.Code: Select all
================================================================= ==97800==ERROR: AddressSanitizer: heap-use-after-free on address 0x61100055a068 at pc 0x000102d11830 bp 0x7ffeeebd4730 sp 0x7ffeeebd4728 READ of size 4 at 0x61100055a068 thread T0 #0 0x102d1182f in DHUDMessageBase* GC::ReadBarrier<DHUDMessageBase>(DHUDMessageBase*&) dobjgc.h:99 #1 0x102cfdef4 in TObjPtr<DHUDMessageBase*>::operator DHUDMessageBase*() dobjgc.h:212 #2 0x102d01823 in DBaseStatusBar::Tick() shared_sbar.cpp:746 #3 0x1032e3d63 in SBar_Tick(DBaseStatusBar*) vmthunks.cpp:2273 #4 0x10ef94139 (<unknown module>) #5 0x102d01e8e in DBaseStatusBar::CallTick() shared_sbar.cpp:790 #6 0x1029a6304 in P_Ticker() p_tick.cpp:168 #7 0x1025eb1ab in G_Ticker() g_game.cpp:1192 #8 0x102597fe7 in TryRunTics() d_net.cpp:1984 #9 0x102572573 in D_DoomLoop() d_main.cpp:1027 #10 0x10257a403 in D_DoomMain() d_main.cpp:2717 #11 0x101042619 in OriginalMainTry(int, char**) i_main.mm:176 #12 0x101047b1d in OriginalMainExcept(int, char**) i_main_except.cpp:49 #13 0x101043a88 in (anonymous namespace)::OriginalMain(int, char**) i_main.mm:211 #14 0x1010434da in -[ApplicationController applicationDidFinishLaunching:] i_main.mm:312 #15 0x7fff45525595 in __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ (CoreFoundation:x86_64h+0x9e595) #16 0x7fff4552550f in ___CFXRegistrationPost_block_invoke (CoreFoundation:x86_64h+0x9e50f) #17 0x7fff45525479 in _CFXRegistrationPost (CoreFoundation:x86_64h+0x9e479) #18 0x7fff4552d927 in ___CFXNotificationPost_block_invoke (CoreFoundation:x86_64h+0xa6927) #19 0x7fff45496383 in -[_CFXNotificationRegistrar find:object:observer:enumerator:] (CoreFoundation:x86_64h+0xf383) #20 0x7fff45495736 in _CFXNotificationPost (CoreFoundation:x86_64h+0xe736) #21 0x7fff4771b06a in -[NSNotificationCenter postNotificationName:object:userInfo:] (Foundation:x86_64+0x1206a) #22 0x7fff42b4e1a7 in -[NSApplication _postDidFinishNotification] (AppKit:x86_64+0x211a7) #23 0x7fff42b4dafa in -[NSApplication _sendFinishLaunchingNotification] (AppKit:x86_64+0x20afa) #24 0x7fff42b4bc4e in -[NSApplication(NSAppleEventHandling) _handleAEOpenEvent:] (AppKit:x86_64+0x1ec4e) #25 0x7fff42b4b89e in -[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:] (AppKit:x86_64+0x1e89e) #26 0x7fff47764beb in -[NSAppleEventManager dispatchRawAppleEvent:withRawReply:handlerRefCon:] (Foundation:x86_64+0x5bbeb) #27 0x7fff47764a68 in _NSAppleEventManagerGenericHandler (Foundation:x86_64+0x5ba68) #28 0x7fff466e6396 in aeDispatchAppleEvent(AEDesc const*, AEDesc*, unsigned int, unsigned char*) (AE:x86_64+0x9396) #29 0x7fff466e5c28 in dispatchEventAndSendReply(AEDesc const*, AEDesc*) (AE:x86_64+0x8c28) #30 0x7fff466e5b00 in aeProcessAppleEvent (AE:x86_64+0x8b00) #31 0x7fff447b6e96 in AEProcessAppleEvent (HIToolbox:x86_64+0x13e96) #32 0x7fff42b47c7d in _DPSNextEvent (AppKit:x86_64+0x1ac7d) #33 0x7fff42b4671e in -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] (AppKit:x86_64+0x1971e) #34 0x7fff42b4083b in -[NSApplication run] (AppKit:x86_64+0x1383b) #35 0x101044dc2 in main i_main.mm:537 #36 0x7fff713f03d4 in start (libdyld.dylib:x86_64+0x163d4) 0x61100055a068 is located 40 bytes inside of 216-byte region [0x61100055a040,0x61100055a118) freed by thread T0 here: #0 0x106caa20d in wrap_free (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5c20d) #1 0x1039aa55f in M_Free(void*) m_alloc.cpp:208 #2 0x1024b06a4 in DObject::operator delete(void*) dobject.h:279 #3 0x102c989e1 in DHUDMessageFadeOut::~DHUDMessageFadeOut() sbar.h:168 #4 0x1025c144d in GC::SweepList(DObject**, unsigned long, unsigned long*) dobjgc.cpp:214 #5 0x1025bef1a in GC::SingleStep() dobjgc.cpp:371 #6 0x1025beca8 in GC::Step() dobjgc.cpp:413 #7 0x102c2e93c in GC::CheckGC() dobjgc.h:110 #8 0x102c2992c in FThinkerList::TickThinkers(FThinkerList*) dthinker.cpp:577 #9 0x102c28785 in FThinkerCollection::RunThinkers(FLevelLocals*) dthinker.cpp:114 #10 0x1029a6145 in P_Ticker() p_tick.cpp:154 #11 0x1025eb1ab in G_Ticker() g_game.cpp:1192 #12 0x102597fe7 in TryRunTics() d_net.cpp:1984 #13 0x102572573 in D_DoomLoop() d_main.cpp:1027 #14 0x10257a403 in D_DoomMain() d_main.cpp:2717 #15 0x101042619 in OriginalMainTry(int, char**) i_main.mm:176 #16 0x101047b1d in OriginalMainExcept(int, char**) i_main_except.cpp:49 #17 0x101043a88 in (anonymous namespace)::OriginalMain(int, char**) i_main.mm:211 #18 0x1010434da in -[ApplicationController applicationDidFinishLaunching:] i_main.mm:312 #19 0x7fff45525595 in __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ (CoreFoundation:x86_64h+0x9e595) #20 0x7fff4552550f in ___CFXRegistrationPost_block_invoke (CoreFoundation:x86_64h+0x9e50f) #21 0x7fff45525479 in _CFXRegistrationPost (CoreFoundation:x86_64h+0x9e479) #22 0x7fff4552d927 in ___CFXNotificationPost_block_invoke (CoreFoundation:x86_64h+0xa6927) #23 0x7fff45496383 in -[_CFXNotificationRegistrar find:object:observer:enumerator:] (CoreFoundation:x86_64h+0xf383) #24 0x7fff45495736 in _CFXNotificationPost (CoreFoundation:x86_64h+0xe736) #25 0x7fff4771b06a in -[NSNotificationCenter postNotificationName:object:userInfo:] (Foundation:x86_64+0x1206a) #26 0x7fff42b4e1a7 in -[NSApplication _postDidFinishNotification] (AppKit:x86_64+0x211a7) #27 0x7fff42b4dafa in -[NSApplication _sendFinishLaunchingNotification] (AppKit:x86_64+0x20afa) #28 0x7fff42b4bc4e in -[NSApplication(NSAppleEventHandling) _handleAEOpenEvent:] (AppKit:x86_64+0x1ec4e) #29 0x7fff42b4b89e in -[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:] (AppKit:x86_64+0x1e89e) previously allocated by thread T0 here: #0 0x106caa053 in wrap_malloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5c053) #1 0x1039aa36b in M_Malloc_Dbg(unsigned long, char const*, int) m_alloc.cpp:137 #2 0x1024cac94 in DObject::operator new(unsigned long, DObject::nonew&) dobject.h:268 #3 0x102705f96 in DHUDMessageFadeOut* Create<DHUDMessageFadeOut, FFont*&, FString&, float&, float&, int&, int&, EColorRange&, float&, float&>(FFont*&&&, FString&&&, float&&&, float&&&, int&&&, int&&&, EColorRange&&&, float&&&, float&&&) dobject.h:361 #4 0x1026a7e31 in DLevelScript::RunScript() p_acs.cpp:8670 #5 0x10270bf5a in P_StartScript(FLevelLocals*, AActor*, line_t*, int, char const*, int const*, int, int) p_acs.cpp:10400 #6 0x10281b841 in LS_ACS_ExecuteWithResult(FLevelLocals*, line_t*, AActor*, bool, int, int, int, int, int) p_lnspec.cpp:1972 #7 0x102810b2f in P_ExecuteSpecial(FLevelLocals*, int, line_t*, AActor*, bool, int, int, int, int, int) p_lnspec.cpp:3936 #8 0x1026f2460 in DLevelScript::CallFunction(int, int, int*) p_acs.cpp:5754 #9 0x10267d1c8 in DLevelScript::RunScript() p_acs.cpp:7121 #10 0x1026d2c40 in DACSThinker::Tick() p_acs.cpp:3421 #11 0x102c2e83f in DThinker::CallTick() dthinker.cpp:854 #12 0x102c298b2 in FThinkerList::TickThinkers(FThinkerList*) dthinker.cpp:575 #13 0x102c28785 in FThinkerCollection::RunThinkers(FLevelLocals*) dthinker.cpp:114 #14 0x1029a6145 in P_Ticker() p_tick.cpp:154 #15 0x1025eb1ab in G_Ticker() g_game.cpp:1192 #16 0x102597fe7 in TryRunTics() d_net.cpp:1984 #17 0x102572573 in D_DoomLoop() d_main.cpp:1027 #18 0x10257a403 in D_DoomMain() d_main.cpp:2717 #19 0x101042619 in OriginalMainTry(int, char**) i_main.mm:176 #20 0x101047b1d in OriginalMainExcept(int, char**) i_main_except.cpp:49 #21 0x101043a88 in (anonymous namespace)::OriginalMain(int, char**) i_main.mm:211 #22 0x1010434da in -[ApplicationController applicationDidFinishLaunching:] i_main.mm:312 #23 0x7fff45525595 in __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ (CoreFoundation:x86_64h+0x9e595) #24 0x7fff4552550f in ___CFXRegistrationPost_block_invoke (CoreFoundation:x86_64h+0x9e50f) #25 0x7fff45525479 in _CFXRegistrationPost (CoreFoundation:x86_64h+0x9e479) #26 0x7fff4552d927 in ___CFXNotificationPost_block_invoke (CoreFoundation:x86_64h+0xa6927) #27 0x7fff45496383 in -[_CFXNotificationRegistrar find:object:observer:enumerator:] (CoreFoundation:x86_64h+0xf383) #28 0x7fff45495736 in _CFXNotificationPost (CoreFoundation:x86_64h+0xe736) #29 0x7fff4771b06a in -[NSNotificationCenter postNotificationName:object:userInfo:] (Foundation:x86_64+0x1206a) SUMMARY: AddressSanitizer: heap-use-after-free dobjgc.h:99 in DHUDMessageBase* GC::ReadBarrier<DHUDMessageBase>(DHUDMessageBase*&) Shadow bytes around the buggy address: 0x1c22000ab3b0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x1c22000ab3c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c22000ab3d0: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c22000ab3e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c22000ab3f0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa =>0x1c22000ab400: fa fa fa fa fa fa fa fa fd fd fd fd fd[fd]fd fd 0x1c22000ab410: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c22000ab420: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa 0x1c22000ab430: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x1c22000ab440: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa 0x1c22000ab450: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc