Viewing Issue Advanced Details
ID Category [?] Severity [?] Reproducibility Date Submitted Last Update
06829 Misc. Critical (emulator) Always Jan 6, 2018, 16:31 Jan 11, 2018, 12:23
Tester Firewave View Status Public Platform
Assigned To Resolution Open OS
Status [?] Acknowledged Driver atarisy2.cpp
Version 0.193 Fixed in Version Build
Summary 06829: 720 and clones: AddressSanitizer: heap-buffer-overflow
Description
==83487==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000097e00 at pc 0x00000c8f1b39 bp 0x7ffc6bd71ab0 sp 0x7ffc6bd71aa8
READ of size 1 at 0x615000097e00 thread T0
    #0 0xc8f1b38 in internal_read /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/machine/eeprom.cpp:307:10
    #1 0xc8f1b38 in eeprom_base_device::read(unsigned int) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/machine/eeprom.cpp:123
    #2 0xc8f49ec in eeprom_parallel_28xx_device::read(address_space&, unsigned int, unsigned char) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/machine/eeprompar.cpp:182:30
    #3 0xe25846c in operator() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/delegate.h:544:11
    #4 0xe25846c in read8 /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem.cpp:405
    #5 0xe25846c in read_native /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem.cpp:1145
    #6 0xe25846c in address_space_specific<unsigned char, (endianness_t)0, 0, false>::read_byte(unsigned int) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem.cpp:1463
    #7 0xae83a06 in m6502_device::mi_default_normal::read(unsigned short) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/cpu/m6502/m6502.cpp:512:18
    #8 0xaeda76c in read /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/cpu/m6502/m6502.h:132:45
    #9 0xaeda76c in m6502_device::lda_abx_full() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../generated/emu/cpu/m6502/m6502.hxx:4650
    #10 0xaf93127 in m6502_device::do_exec_full() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../generated/emu/cpu/m6502/m6502.hxx:14709:13
    #11 0xae81f62 in execute_run /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/cpu/m6502/m6502.cpp:388:3
    #12 0xae81f62 in non-virtual thunk to m6502_device::execute_run() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/cpu/m6502/m6502.cpp
    #13 0xe78e272 in run /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/diexec.h:188:15
    #14 0xe78e272 in device_scheduler::timeslice() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:481
    #15 0xe6a324b in running_machine::run(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:357:17
    #16 0x8cd10e0 in mame_machine_manager::execute() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:236:19
    #17 0x8e1e0d3 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:257:22
    #18 0x8e20ee0 in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:273:3
    #19 0x8cd3717 in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:336:18
    #20 0x8acddf2 in main /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:216:9
    #21 0x7f2233f3182f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
    #22 0x1431838 in _start (/mnt/mame/mame64_as+0x1431838)

0x615000097e00 is located 0 bytes to the right of 512-byte region [0x615000097c00,0x615000097e00)
allocated by thread T0 here:
    #0 0x14fd8a2 in operator new[](unsigned long) /opt/media/clang_nightly/llvm/utils/release/final/llvm.src/projects/compiler-rt/lib/asan/asan_new_delete.cc:95:3
    #1 0xc8f3555 in make_unique<unsigned char []> /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/unique_ptr.h:771:30
    #2 0xc8f3555 in eeprom_base_device::device_start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/machine/eeprom.cpp:207
    #3 0xc8f46bd in device_start /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/machine/eeprompar.cpp:80:22
    #4 0xc8f46bd in eeprom_parallel_28xx_device::device_start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/machine/eeprompar.cpp:131
    #5 0xe0e345d in device_t::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/device.cpp:489:2
    #6 0xe6a1f65 in running_machine::start_all_devices() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:1040:13
    #7 0xe6a005d in running_machine::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:265:2
    #8 0xe6a2a41 in running_machine::run(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:310:3
    #9 0x8cd10e0 in mame_machine_manager::execute() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:236:19
    #10 0x8e1e0d3 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:257:22
    #11 0x8e20ee0 in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:273:3
    #12 0x8cd3717 in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:336:18
    #13 0x8acddf2 in main /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:216:9
    #14 0x7f2233f3182f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291

SUMMARY: AddressSanitizer: heap-buffer-overflow /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/machine/eeprom.cpp:307:10 in internal_read
Shadow bytes around the buggy address:
  0x0c2a8000af70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2a8000af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a8000af90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a8000afa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a8000afb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2a8000afc0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2a8000afd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a8000afe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a8000aff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a8000b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a8000b010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable: 00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone: fa
  Freed heap region: fd
  Stack left redzone: f1
  Stack mid redzone: f2
  Stack right redzone: f3
  Stack after return: f5
  Stack use after scope: f8
  Global redzone: f9
  Global init order: f6
  Poisoned by user: f7
  Container overflow: fc
  Array cookie: ac
  Intra object redzone: bb
  ASan internal: fe
  Left alloca redzone: ca
  Right alloca redzone: cb
Steps To Reproduce
Additional Information
Flags
Regression Version
Affected Sets / Systems 720 and clones
Attached Files
 
Relationships
There are no relationship linked to this issue.
Notes
1
User avatar
No.14649
Firewave
Senior Tester
Jan 11, 2018, 12:23
It access the NVRAM at index 256 and then at index 512 (which is out-of-bounds already) and then starts going back from index 511. Looks like it is testing how big the NVRAM is and the out-of-bounds access is supposed to return a certain (or not a certain) value so it knows that is not available. Since this is the generic eeprom code I wonder if there is some feature missing.