Viewing Issue Advanced Details
[ Jump to Notes ]
sega/model1.cpp
ID Category [?] Severity [?] Reproducibility Date Submitted Last Update
06600 Crash/Freeze Critical (emulator) Sometimes Jun 3, 2017, 00:06 Nov 11, 2022, 14:08
Tester AJR View Status Public Platform MAME (Self-compiled)
Assigned To Resolution Open OS MacOS X
Status [?] Confirmed Driver
sega/model1.cpp
Version 0.186 Fixed in Version Build 64-bit
Fixed in Git Commit Github Pull Request #
Summary 06600: netmerc: Segmentation fault
Description The game sometimes exits with "Segmentation fault: 11" a few seconds after emulation starts, sometimes on the region warning screen and sometimes when exiting MAME.
Steps To Reproduce Start the machine.
Additional Information Yes, Sega NetMerc is tagged MACHINE_NOT_WORKING (as is its closest relation, Wing War), but even that is no excuse for emulator crashes.
Github Commit
Flags
Regression Version
Affected Sets / Systems netmerc
Attached Files
  
Relationships
There are no relationship linked to this issue.
Notes
4
User avatar
No.13877
B2K24
Senior Tester
Jun 3, 2017, 04:36
edited on: Jun 3, 2017, 04:41
 
Exception at EIP=00000000044ab0ef (address_table_setoffset::~address_table_setoffset()+0x003f): ACCESS VIOLATION
While attempting to read memory at ffffffffffffffff
-----------------------------------------------------
RAX=3f70f0f13e7cfcfd RBX=000000001801e7a8 RCX=000000001ff586c0 RDX=0000000000000000
RSI=000000001801e238 RDI=000000001801dd58 RBP=000000000b678680 RSP=000000000b678600
R8=00000000001c24c0 R9=0000000000008000 R10=00000000001c0cc0 R11=0000000018022850
R12=000000000b678720 R13=000000000b678770 R14=0000000009fe2100 R15=000000000b678780
-----------------------------------------------------
Stack crawl:
000000000b6785c0: 00000000044ab0ef (address_table_setoffset::~address_table_setoffset()+0x003f)
000000000b678680: 00000000044964bb (address_space_specific<unsigned short, (endianness_t)1, true>::~address_space_specific()+0x002b)
000000000b6786e0: 00000000031cedee (running_machine::~running_machine()+0x041e)
000000000b67f430: 0000000001beed50 (mame_machine_manager::execute()+0x01f0)
000000000b67f530: 0000000001c4d255 (cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>,std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&)+0x01d5)
000000000b67f6a0: 0000000001c4d445 (cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&)+0x0045)
000000000b67f700: 0000000001beceba (emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&)+0x002a)
000000000b67fdb0: 0000000001b43142 (utf8_main(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&)+0x0122)
000000000b67fe50: 00000000037451b9 (wmain+0x0169)
000000000b67ff20: 0000000000401410 (__tmainCRTStartup+0x0260)
000000000b67ff50: 000000000040153b (mainCRTStartup+0x001b)
000000000b67ff80: 00007ffb31dc8364 (BaseThreadInitThunk+0x0014)
000000000b67ffd0: 00007ffb348970d1 (RtlUserThreadStart+0x0021)
User avatar
No.14595
Firewave
Senior Tester
Dec 31, 2017, 23:57
edited on: Jan 1, 2018, 20:43
 
==119150==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000017604 at pc 0x000003f2a9ba bp 0x7ffea14cb790 sp 0x7ffea14cb788
WRITE of size 4 at 0x617000017604 thread T0
    #0 0x3f2a9b9 in set_lightparam /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/video/model1.cpp:1267:23
    #1 0x3f2a9b9 in model1_state::tgp_render(bitmap_rgb32&, rectangle const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/video/model1.cpp:1396
    #2 0x3f2c4b5 in model1_state::screen_update_model1(screen_device&, bitmap_rgb32&, rectangle const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/video/model1.cpp:1660:2
    #3 0xe7ac0e2 in operator() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/delegate.h:544:11
    #4 0xe7ac0e2 in screen_device::update_partial(int) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1220
    #5 0xe833c67 in video_manager::finish_screen_updates() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/video.cpp:694:10
    #6 0xe8332a0 in video_manager::frame_update(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/video.cpp:208:27
    #7 0xe7a9f66 in vblank_end /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1556:21
    #8 0xe7a9f66 in screen_device::device_timer(emu_timer&, unsigned int, int, void*) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1002
    #9 0xe795168 in timer_expired /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/device.h:520:83
    #10 0xe795168 in device_scheduler::execute_timers() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:906
    #11 0xe78ea0f in device_scheduler::timeslice() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:530:2
    #12 0xe6a324b in running_machine::run(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:357:17
    #13 0x8cd10e0 in mame_machine_manager::execute() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:236:19
    #14 0x8e1e0d3 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:257:22
    #15 0x8e20ee0 in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:273:3
    #16 0x8cd3717 in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:336:18
    #17 0x8acddf2 in main /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:216:9
    #18 0x7f943897082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #19 0x1431838 in _start (/mnt/mame/mame64+0x1431838)

0x617000017604 is located 0 bytes to the right of 644-byte region [0x617000017380,0x617000017604)
allocated by thread T0 here:
    #0 0x14fd8a2 in operator new[](unsigned long) /opt/media/clang_nightly/llvm/utils/release/final/llvm.src/projects/compiler-rt/lib/asan/asan_new_delete.cc:95:3
    #1 0xf13f7e6 in bitmap_t::allocate(int, int, int, int) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/bitmap.cpp:210:16
    #2 0xe6f6b6b in render_font::char_expand(char32_t, render_font::glyph&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/rendfont.cpp:718:13
    #3 0xe6fe874 in render_font::get_char(char32_t) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/rendfont.cpp:539:4
    #4 0xe6f7e57 in render_font::char_width(float, float, char32_t) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/rendfont.cpp:851:15
    #5 0x919aa71 in get_char_width /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/text.cpp:316:16
    #6 0x919aa71 in ui::text_layout::line::add_character(char32_t, ui::text_layout::char_style const&, ui::text_layout::source_info const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/text.cpp:530
    #7 0x9199fdb in ui::text_layout::add_text(char const*, ui::text_layout::char_style const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/text.cpp:185:20
    #8 0x8d9199b in add_text /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/text.h:77:3
    #9 0x8d9199b in draw_text_box /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/ui.cpp:611
    #10 0x8d9199b in mame_ui_manager::handler_messagebox_anykey(render_container&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/ui.cpp:789
    #11 0x8da3ed9 in operator()<render_container &, void> /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/functional:600:11
    #12 0x8da3ed9 in __call<unsigned int, render_container &, 0, 1> /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/functional:1073
    #13 0x8da3ed9 in operator()<render_container &, unsigned int> /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/functional:1131
    #14 0x8da3ed9 in std::_Function_handler<unsigned int (render_container&), std::_Bind<std::_Mem_fn<unsigned int (mame_ui_manager::*)(render_container&)> (mame_ui_manager*, std::_Placeholder<1>)> >::_M_invoke(std::_Any_data const&, render_container&) /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/functional:1856
    #15 0x8d92475 in operator() /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/functional:2267:14
    #16 0x8d92475 in mame_ui_manager::update_and_render(render_container&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/ui.cpp:414
    #17 0x8cd3cb9 in emulator_info::draw_user_interface(running_machine&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:347:41
    #18 0xe833354 in video_manager::frame_update(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/video.cpp:220:2
    #19 0x8d8e1e9 in mame_ui_manager::display_startup_screens(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/ui.cpp:350:22
    #20 0x8cd2d73 in mame_machine_manager::ui_initialize(running_machine&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:298:8
    #21 0xe6a2f9a in running_machine::run(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:332:13
    #22 0x8cd10e0 in mame_machine_manager::execute() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:236:19
    #23 0x8e1e0d3 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:257:22
    #24 0x8e20ee0 in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:273:3
    #25 0x8cd3717 in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:336:18
    #26 0x8acddf2 in main /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:216:9
    #27 0x7f943897082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/video/model1.cpp:1267:23 in set_lightparam
Shadow bytes around the buggy address:
  0x0c2e7fffae70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffae80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffae90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffaea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffaeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2e7fffaec0:[04]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fffaed0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fffaee0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fffaef0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fffaf00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fffaf10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
User avatar
No.14598
Firewave
Senior Tester
Jan 1, 2018, 20:39
edited on: Jan 1, 2018, 20:42
 
../../../../../src/mame/video/model1.cpp:1265:2: runtime error: index 128 out of bounds for type 'model1_state::lightparam_t [32]'
../../../../../src/mame/video/model1.cpp:1266:2: runtime error: index 128 out of bounds for type 'model1_state::lightparam_t [32]'
../../../../../src/mame/video/model1.cpp:1267:2: runtime error: index 128 out of bounds for type 'model1_state::lightparam_t [32]'
../../../../../src/mame/video/model1.cpp:1268:2: runtime error: index 128 out of bounds for type 'model1_state::lightparam_t [32]'

And later on these happen (the first two could be caused by the out of bounds writes though).
../../../../../3rdparty/glm/glm/detail/func_exponential.inl:132:34: runtime error: division by zero
../../../../../src/devices/cpu/v60/op2.hxx:205:7: runtime error: division by zero
../../../../../src/mame/video/model1.cpp:80:11: runtime error: 1.12339e+10 is outside the range of representable values of type 'int'
../../../../../src/mame/video/model1.cpp:78:15: runtime error: division by zero
../../../../../src/mame/video/model1.cpp:79:15: runtime error: division by zero
../../../../../src/mame/video/model1.cpp:81:11: runtime error: -inf is outside the range of representable values of type 'int'

And while we're at it - before the machine even starts running (before the warning screen) there's these (unrelated) warnings:
../../../../../src/devices/sound/multipcm.cpp:572:49: runtime error: division by zero
../../../../../src/devices/sound/multipcm.cpp:572:22: runtime error: inf is outside the range of representable values of type 'unsigned int'
../../../../../src/devices/sound/multipcm.cpp:573:56: runtime error: division by zero
../../../../../src/devices/sound/multipcm.cpp:573:29: runtime error: inf is outside the range of representable values of type 'unsigned int'
User avatar
No.20800
Firewave
Senior Tester
Nov 11, 2022, 14:08
 Using 0.249 on Linux reports:
../../../../../src/mame/sega/model1_v.cpp:1270:2: runtime error: index 128 out of bounds for type 'model1_state::lightparam_t[32]'
    #0 0x7f866521c0fe in model1_state::view_t::set_lightparam(int, float, float, float, int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/sega/model1_v.cpp:1270:21
    #1 0x7f866521dbad in model1_state::tgp_render(bitmap_rgb32&, rectangle const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/sega/model1_v.cpp:1401:14
    #2 0x7f8665222f38 in model1_state::screen_update_model1(screen_device&, bitmap_rgb32&, rectangle const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/sega/model1_v.cpp:1664:2
    #3 0x7f867420889d in util::detail::delegate_base<delegate_late_bind, unsigned int, screen_device&, bitmap_rgb32&, rectangle const&>::operator()(screen_device&, bitmap_rgb32&, rectangle const&) const /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/delegate.h:765:11
    #4 0x7f867eedc751 in screen_device::update_partial(int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1216:41
    #5 0x7f867efdcca9 in video_manager::finish_screen_updates() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/video.cpp:622:10
    #6 0x7f867efdbaab in video_manager::frame_update(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/video.cpp:215:44
    #7 0x7f867eed37c2 in screen_device::vblank_end(int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1678:21
    #8 0x7f867eebb854 in operator() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/delegate.h:765:11
    #9 0x7f867eebb854 in device_scheduler::execute_timers() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:951:5
    #10 0x7f867eeb6798 in device_scheduler::timeslice() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:505:2
    #11 0x7f867ed53207 in running_machine::run(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:329:17
    #12 0x7f8676e62e4f in mame_machine_manager::execute() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:290:19
    #13 0x7f867821a1c6 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:275:22
    #14 0x7f867821dd0f in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:291:3
    #15 0x7f8676e67c2f in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:454:18
    #16 0x7f867f04929b in main /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:191:9
    #17 0x7f8631d89209 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #18 0x7f8631d892bb in __libc_start_main csu/../csu/libc-start.c:389:3
    #19 0x7f86589d9d80 in _start (/mnt/s/GitHub/mame/mame+0x24d5fd80) (BuildId: 94a5374e261be8f8)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../../../../src/mame/sega/model1_v.cpp:1270:2 in


==7999==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6170007e5290 at pc 0x7f866521c0a5 bp 0x7ffffbac8f90 sp 0x7ffffbac8f88
WRITE of size 4 at 0x6170007e5290 thread T0
    #0 0x7f866521c0a4 in model1_state::view_t::set_lightparam(int, float, float, float, int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/sega/model1_v.cpp:1270:23
    #1 0x7f866521dbad in model1_state::tgp_render(bitmap_rgb32&, rectangle const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/sega/model1_v.cpp:1401:14
    #2 0x7f8665222f38 in model1_state::screen_update_model1(screen_device&, bitmap_rgb32&, rectangle const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/sega/model1_v.cpp:1664:2
    #3 0x7f867420889d in util::detail::delegate_base<delegate_late_bind, unsigned int, screen_device&, bitmap_rgb32&, rectangle const&>::operator()(screen_device&, bitmap_rgb32&, rectangle const&) const /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/delegate.h:765:11
    #4 0x7f867eedc751 in screen_device::update_partial(int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1216:41
    #5 0x7f867efdcca9 in video_manager::finish_screen_updates() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/video.cpp:622:10
    #6 0x7f867efdbaab in video_manager::frame_update(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/video.cpp:215:44
    #7 0x7f867eed37c2 in screen_device::vblank_end(int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1678:21
    #8 0x7f867eebb854 in operator() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/delegate.h:765:11
    #9 0x7f867eebb854 in device_scheduler::execute_timers() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:951:5
    #10 0x7f867eeb6798 in device_scheduler::timeslice() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:505:2
    #11 0x7f867ed53207 in running_machine::run(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:329:17
    #12 0x7f8676e62e4f in mame_machine_manager::execute() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:290:19
    #13 0x7f867821a1c6 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:275:22
    #14 0x7f867821dd0f in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:291:3
    #15 0x7f8676e67c2f in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:454:18
    #16 0x7f867f04929b in main /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:191:9
    #17 0x7f8631d89209 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #18 0x7f8631d892bb in __libc_start_main csu/../csu/libc-start.c:389:3
    #19 0x7f86589d9d80 in _start (/mnt/s/GitHub/mame/mame+0x24d5fd80) (BuildId: 94a5374e261be8f8)

0x6170007e5290 is located 607 bytes to the right of 689-byte region [0x6170007e4d80,0x6170007e5031)
freed by thread T0 here:
    #0 0x7f8658a9827d in operator delete(void*) (/mnt/s/GitHub/mame/mame+0x24e1e27d) (BuildId: 94a5374e261be8f8)
    #1 0x7f867749f501 in ~basic_string /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/basic_string.h:795:9
    #2 0x7f867749f501 in mame_ui_manager::display_startup_screens(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/ui.cpp:480:4
    #3 0x7f8676e65667 in mame_machine_manager::ui_initialize(running_machine&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:366:8
    #4 0x7f867ed530b6 in running_machine::run(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:306:13
    #5 0x7f8676e62e4f in mame_machine_manager::execute() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:290:19
    #6 0x7f867821a1c6 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:275:22
    #7 0x7f867821dd0f in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:291:3
    #8 0x7f8676e67c2f in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:454:18
    #9 0x7f867f04929b in main /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:191:9
    #10 0x7f8631d89209 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

previously allocated by thread T0 here:
    #0 0x7f8658a97a1d in operator new(unsigned long) (/mnt/s/GitHub/mame/mame+0x24e1da1d) (BuildId: 94a5374e261be8f8)
    #1 0x7f86320cfc0d in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0x13fc0d) (BuildId: 00bbb52a4fbeaea07adbaa5ddc677c5d83686151)

SUMMARY: AddressSanitizer: heap-buffer-overflow /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/sega/model1_v.cpp:1270:23 in model1_state::view_t::set_lightparam(int, float, float, float, int)
Shadow bytes around the buggy address:
  0x0c2e800f4a00: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
  0x0c2e800f4a10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e800f4a20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e800f4a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e800f4a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c2e800f4a50: fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e800f4a60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e800f4a70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e800f4a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e800f4a90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e800f4aa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb