- --
Viewing Issue Advanced Details
ID | Category [?] | Severity [?] | Reproducibility | Date Submitted | Last Update |
---|---|---|---|---|---|
05666 | Misc. | Critical (emulator) | Always | Aug 11, 2014, 14:18 | Aug 12, 2014, 11:43 |
Tester | Firewave | View Status | Public | Platform | MAME (Self-compiled) |
Assigned To | hap | Resolution | Fixed | OS | Linux |
Status [?] | Resolved | Driver | |||
Version | 0.154 | Fixed in Version | 0.155 | Build | Debug |
Fixed in Git Commit | Github Pull Request # | ||||
Summary | 05666: cswat: AddressSanitizer: heap-buffer-overflow with -aviwrite | ||||
Description |
==13306==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000035688 at pc 0x84c773a bp 0x7fff229fda70 sp 0x7fff229fda68 READ of size 4 at 0x619000035688 thread T0 #0 0x84c7739 in rgb_t::operator unsigned int() const /home/notroot/trunk/src/lib/util/palette.h:59 #1 0x84c7739 in software_renderer<unsigned int, 0, 0, 0, 16, 8, 0, false, true>::get_texel_palette16(render_texinfo const&, int, int) /home/notroot/trunk/src/emu/rendersw.inc:148 #2 0x84c7739 in software_renderer<unsigned int, 0, 0, 0, 16, 8, 0, false, true>::draw_quad_palette16_none(render_primitive const&, unsigned int*, unsigned int, software_renderer<unsigned int, 0, 0, 0, 16, 8, 0, false, true>::quad_setup_data&) /home/notroot/trunk/src/emu/rendersw.inc:638 #3 0x84c5ba4 in software_renderer<unsigned int, 0, 0, 0, 16, 8, 0, false, true>::setup_and_draw_textured_quad(render_primitive const&, unsigned int*, int, int, unsigned int) /home/notroot/trunk/src/emu/rendersw.inc:1866 #4 0x84c39ce in software_renderer<unsigned int, 0, 0, 0, 16, 8, 0, false, true>::draw_primitives(render_primitive_list const&, void*, unsigned int, unsigned int, unsigned int) /home/notroot/trunk/src/emu/rendersw.inc:1934 #5 0x84bff50 in video_manager::create_snapshot_bitmap(screen_device*) /home/notroot/trunk/src/emu/video.c:1077 #6 0x84c1f47 in video_manager::record_frame() /home/notroot/trunk/src/emu/video.c:1225 #7 0x84bc2f9 in video_manager::finish_screen_updates() /home/notroot/trunk/src/emu/video.c:661 #8 0x84bb3d4 in video_manager::frame_update(bool) /home/notroot/trunk/src/emu/video.c:202 #9 0x8422da1 in screen_device::vblank_begin() /home/notroot/trunk/src/emu/screen.c:822 #10 0x8422a79 in screen_device::device_timer(emu_timer&, unsigned int, int, void*) /home/notroot/trunk/src/emu/screen.c:404 #11 0x8419d53 in device_t::timer_expired(emu_timer&, unsigned int, int, void*) /home/notroot/trunk/src/emu/device.h:189 #12 0x8419d53 in device_scheduler::execute_timers() /home/notroot/trunk/src/emu/schedule.c:902 #13 0x84146b9 in device_scheduler::timeslice() /home/notroot/trunk/src/emu/schedule.c:517 #14 0x8335a11 in running_machine::run(bool) /home/notroot/trunk/src/emu/machine.c:377 #15 0x832d897 in machine_manager::execute() /home/notroot/trunk/src/emu/mame.c:216 #16 0x813fd28 in cli_frontend::execute(int, char**) /home/notroot/trunk/src/emu/clifront.c:243 #17 0x59ac224 in main /home/notroot/trunk/src/osd/sdl/sdlmain.c:332 #18 0x7f7345c19de4 in __libc_start_main /build/buildd/eglibc-2.17/csu/libc-start.c:260 #19 0x10bb54c in _start (/home/notroot/trunk/mame64d+0x10bb54c) 0x619000035688 is located 0 bytes to the right of 1032-byte region [0x619000035280,0x619000035688) allocated by thread T0 here: #0 0x10a5469 in __interceptor_malloc /home/ben/development/llvm/3.4/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74 #1 0x8c0fce8 in osd_malloc_array(unsigned long) /home/notroot/trunk/src/osd/sdl/sdlos_unix.c:108 #2 0x876ebfd in malloc_file_line(unsigned long, char const*, int, bool, bool, bool) /home/notroot/trunk/src/lib/util/corealloc.c:112 #3 0x878eb4f in palette_t::palette_t(unsigned int, unsigned int) /home/notroot/trunk/src/lib/util/corealloc.h:72 #4 0x878e609 in palette_t::alloc(unsigned int, unsigned int) /home/notroot/trunk/src/lib/util/palette.c:199 #5 0x81f4881 in palette_device::allocate_palette() /home/notroot/trunk/src/emu/emupal.c:569 #6 0x81f3afb in palette_device::device_start() /home/notroot/trunk/src/emu/emupal.c:453 #7 0x8163629 in device_t::start() /home/notroot/trunk/src/emu/device.c:392 #8 0x833503b in running_machine::start_all_devices() /home/notroot/trunk/src/emu/machine.c:1053 #9 0x8332625 in running_machine::start() /home/notroot/trunk/src/emu/machine.c:278 #10 0x833589d in running_machine::run(bool) /home/notroot/trunk/src/emu/machine.c:342 #11 0x832d897 in machine_manager::execute() /home/notroot/trunk/src/emu/mame.c:216 #12 0x813fd28 in cli_frontend::execute(int, char**) /home/notroot/trunk/src/emu/clifront.c:243 #13 0x59ac224 in main /home/notroot/trunk/src/osd/sdl/sdlmain.c:332 #14 0x7f7345c19de4 in __libc_start_main /build/buildd/eglibc-2.17/csu/libc-start.c:260 SUMMARY: AddressSanitizer: heap-buffer-overflow /home/notroot/trunk/src/lib/util/palette.h:59 rgb_t::operator unsigned int() const Shadow bytes around the buggy address: 0x0c327fffea80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c327fffea90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c327fffeaa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c327fffeab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c327fffeac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c327fffead0: 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c327fffeae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c327fffeaf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c327fffeb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c327fffeb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c327fffeb20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 ASan internal: fe |
||||
Steps To Reproduce | |||||
Additional Information | |||||
Github Commit | |||||
Flags | |||||
Regression Version | |||||
Affected Sets / Systems | cswat | ||||
Attached Files
|
|||||
Relationships
There are no relationship linked to this issue. |
Notes
1
No.10915
Firewave Senior Tester
Aug 12, 2014, 11:43
|
Fixed in r31620 |
---|