- --
Viewing Issue Advanced Details
| ID | Category [?] | Severity [?] | Reproducibility | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 05666 | Misc. | Critical (emulator) | Always | Aug 11, 2014, 14:18 | Aug 12, 2014, 11:43 |
| Tester | Firewave | View Status | Public | Platform | MAME (Self-compiled) |
| Assigned To | hap | Resolution | Fixed | OS | Linux |
| Status [?] | Resolved | Driver | |||
| Version | 0.154 | Fixed in Version | 0.155 | Build | Debug |
| Fixed in Git Commit | Github Pull Request # | ||||
| Summary | 05666: cswat: AddressSanitizer: heap-buffer-overflow with -aviwrite | ||||
| Description |
==13306==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000035688 at pc 0x84c773a bp 0x7fff229fda70 sp 0x7fff229fda68
READ of size 4 at 0x619000035688 thread T0
#0 0x84c7739 in rgb_t::operator unsigned int() const /home/notroot/trunk/src/lib/util/palette.h:59
#1 0x84c7739 in software_renderer<unsigned int, 0, 0, 0, 16, 8, 0, false, true>::get_texel_palette16(render_texinfo const&, int, int) /home/notroot/trunk/src/emu/rendersw.inc:148
#2 0x84c7739 in software_renderer<unsigned int, 0, 0, 0, 16, 8, 0, false, true>::draw_quad_palette16_none(render_primitive const&, unsigned int*, unsigned int, software_renderer<unsigned int, 0, 0, 0, 16, 8, 0, false, true>::quad_setup_data&) /home/notroot/trunk/src/emu/rendersw.inc:638
#3 0x84c5ba4 in software_renderer<unsigned int, 0, 0, 0, 16, 8, 0, false, true>::setup_and_draw_textured_quad(render_primitive const&, unsigned int*, int, int, unsigned int) /home/notroot/trunk/src/emu/rendersw.inc:1866
#4 0x84c39ce in software_renderer<unsigned int, 0, 0, 0, 16, 8, 0, false, true>::draw_primitives(render_primitive_list const&, void*, unsigned int, unsigned int, unsigned int) /home/notroot/trunk/src/emu/rendersw.inc:1934
#5 0x84bff50 in video_manager::create_snapshot_bitmap(screen_device*) /home/notroot/trunk/src/emu/video.c:1077
#6 0x84c1f47 in video_manager::record_frame() /home/notroot/trunk/src/emu/video.c:1225
#7 0x84bc2f9 in video_manager::finish_screen_updates() /home/notroot/trunk/src/emu/video.c:661
#8 0x84bb3d4 in video_manager::frame_update(bool) /home/notroot/trunk/src/emu/video.c:202
#9 0x8422da1 in screen_device::vblank_begin() /home/notroot/trunk/src/emu/screen.c:822
#10 0x8422a79 in screen_device::device_timer(emu_timer&, unsigned int, int, void*) /home/notroot/trunk/src/emu/screen.c:404
#11 0x8419d53 in device_t::timer_expired(emu_timer&, unsigned int, int, void*) /home/notroot/trunk/src/emu/device.h:189
#12 0x8419d53 in device_scheduler::execute_timers() /home/notroot/trunk/src/emu/schedule.c:902
#13 0x84146b9 in device_scheduler::timeslice() /home/notroot/trunk/src/emu/schedule.c:517
#14 0x8335a11 in running_machine::run(bool) /home/notroot/trunk/src/emu/machine.c:377
#15 0x832d897 in machine_manager::execute() /home/notroot/trunk/src/emu/mame.c:216
#16 0x813fd28 in cli_frontend::execute(int, char**) /home/notroot/trunk/src/emu/clifront.c:243
#17 0x59ac224 in main /home/notroot/trunk/src/osd/sdl/sdlmain.c:332
#18 0x7f7345c19de4 in __libc_start_main /build/buildd/eglibc-2.17/csu/libc-start.c:260
#19 0x10bb54c in _start (/home/notroot/trunk/mame64d+0x10bb54c)
0x619000035688 is located 0 bytes to the right of 1032-byte region [0x619000035280,0x619000035688)
allocated by thread T0 here:
#0 0x10a5469 in __interceptor_malloc /home/ben/development/llvm/3.4/final/llvm.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:74
#1 0x8c0fce8 in osd_malloc_array(unsigned long) /home/notroot/trunk/src/osd/sdl/sdlos_unix.c:108
#2 0x876ebfd in malloc_file_line(unsigned long, char const*, int, bool, bool, bool) /home/notroot/trunk/src/lib/util/corealloc.c:112
#3 0x878eb4f in palette_t::palette_t(unsigned int, unsigned int) /home/notroot/trunk/src/lib/util/corealloc.h:72
#4 0x878e609 in palette_t::alloc(unsigned int, unsigned int) /home/notroot/trunk/src/lib/util/palette.c:199
#5 0x81f4881 in palette_device::allocate_palette() /home/notroot/trunk/src/emu/emupal.c:569
#6 0x81f3afb in palette_device::device_start() /home/notroot/trunk/src/emu/emupal.c:453
#7 0x8163629 in device_t::start() /home/notroot/trunk/src/emu/device.c:392
#8 0x833503b in running_machine::start_all_devices() /home/notroot/trunk/src/emu/machine.c:1053
#9 0x8332625 in running_machine::start() /home/notroot/trunk/src/emu/machine.c:278
#10 0x833589d in running_machine::run(bool) /home/notroot/trunk/src/emu/machine.c:342
#11 0x832d897 in machine_manager::execute() /home/notroot/trunk/src/emu/mame.c:216
#12 0x813fd28 in cli_frontend::execute(int, char**) /home/notroot/trunk/src/emu/clifront.c:243
#13 0x59ac224 in main /home/notroot/trunk/src/osd/sdl/sdlmain.c:332
#14 0x7f7345c19de4 in __libc_start_main /build/buildd/eglibc-2.17/csu/libc-start.c:260
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/notroot/trunk/src/lib/util/palette.h:59 rgb_t::operator unsigned int() const
Shadow bytes around the buggy address:
0x0c327fffea80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fffea90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fffeaa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fffeab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fffeac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c327fffead0: 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c327fffeae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c327fffeaf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fffeb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fffeb10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fffeb20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
ASan internal: fe
|
||||
| Steps To Reproduce | |||||
| Additional Information | |||||
| Github Commit | |||||
| Flags | |||||
| Regression Version | |||||
| Affected Sets / Systems | cswat | ||||
|
Attached Files
|
|||||
Relationships
| There are no relationship linked to this issue. |
Notes
1
|
No.10915
Firewave Senior Tester
Aug 12, 2014, 11:43
|
Fixed in r31620 |
|---|