[Fixed] heap-use-after-free when detaching a dynamic light

Bugs that have been investigated and resolved somehow.

Moderator: GZDoom Developers

heap-use-after-free when detaching a dynamic light

Postby Talon1024 » Sat Jun 05, 2021 12:32 pm

When A_RemoveLight is called, it causes a heap-use-after-free error according to AddressSanitizer.

Here's a small example. To reproduce the issue, load the example with an AddressSanitizer-enabled GZDoom build, enter "summon LampWeapon" into the console, pick it up, select it (slot 1), turn it on (primary fire), and turn it back off (primary fire)

Code: Select allExpand view
=================================================================
==9441==ERROR: AddressSanitizer: heap-use-after-free on address 0x60800048c5b0 at pc 0x55b701141784 bp 0x7ffefcfefa70 sp 0x7ffefcfefa60
READ of size 4 at 0x60800048c5b0 thread T0
    #0 0x55b701141783 in FDynamicLight::GetIntensity() const ../src/playsim/a_dynlight.h:218
    #1 0x55b701138061 in FDynamicLight::Tick() ../src/playsim/a_dynlight.cpp:353
    #2 0x55b70117143f in FThinkerCollection::RunThinkers(FLevelLocals*) ../src/playsim/dthinker.cpp:130
    #3 0x55b700ff605f in P_Ticker() ../src/p_tick.cpp:171
    #4 0x55b700d5ac1e in G_Ticker() ../src/g_game.cpp:1288
    #5 0x55b700d32a6e in TryRunTics() ../src/d_net.cpp:1987
    #6 0x55b700d0e7e4 in D_DoomLoop() ../src/d_main.cpp:1290
    #7 0x55b700d1c915 in D_DoomMain_Internal ../src/d_main.cpp:3653
    #8 0x55b700d1d175 in GameMain() ../src/d_main.cpp:3683
    #9 0x55b7005bbd3b in main ../src/common/platform/posix/sdl/i_main.cpp:194
    #10 0x7fb40eefb0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #11 0x55b7005ad9cd in _start (/home/kevinc/Games/doom/gzdoom-master-20210531/gzdooma+0x9009cd)

0x60800048c5b0 is located 16 bytes inside of 96-byte region [0x60800048c5a0,0x60800048c600)
freed by thread T0 here:
    #0 0x7fb40fb83025 in operator delete(void*, unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x111025)
    #1 0x55b70113f09a in RemoveLight(AActor*, int) ../src/playsim/a_dynlight.cpp:931
    #2 0x7fb3f7a91304  (<unknown module>)

previously allocated by thread T0 here:
    #0 0x7fb40fb81947 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10f947)
    #1 0x55b70113cfdb in FindUserLight(AActor*, FName, bool) ../src/playsim/a_dynlight.cpp:827
    #2 0x55b70113d285 in AttachLightDef(AActor*, int, int) ../src/playsim/a_dynlight.cpp:850
    #3 0x7fb3f7a9121f  (<unknown module>)

SUMMARY: AddressSanitizer: heap-use-after-free ../src/playsim/a_dynlight.h:218 in FDynamicLight::GetIntensity() const
Shadow bytes around the buggy address:
  0x0c1080089860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1080089870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1080089880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1080089890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c10800898a0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c10800898b0: fa fa fa fa fd fd[fd]fd fd fd fd fd fd fd fd fd
  0x0c10800898c0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c10800898d0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c10800898e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c10800898f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1080089900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==9441==ABORTING
Talon1024
 
 
 
Joined: 27 Jun 2016
Github ID: Talon1024
Operating System: Debian-like Linux (Debian, Ubuntu, Mint, etc) 64-bit
Graphics Processor: nVidia with Vulkan support

Re: heap-use-after-free when detaching a dynamic light

Postby Graf Zahl » Wed Aug 11, 2021 7:42 am

Should be fixed now.
User avatar
Graf Zahl
Lead GZDoom+Raze Developer
Lead GZDoom+Raze Developer
 
Joined: 19 Jul 2003
Location: Germany


Return to Closed Bugs

Who is online

Users browsing this forum: No registered users and 0 guests