Viewing Issue Advanced Details
ID Category [?] Severity [?] Reproducibility Date Submitted Last Update
06832 Misc. Critical (emulator) Always Jan 7, 2018, 17:17 Apr 23, 2019, 11:28
Tester Firewave View Status Public Platform MAME (Official Binary)
Assigned To Pernod Resolution Fixed OS
Status [?] Resolved Driver
Version 0.193 Fixed in Version 0.206 Build
Fixed in Git Commit Github Pull Request #
Summary MESS-specific 06832: All dragon.cpp sets: AddressSanitizer: heap-buffer-overflow with -cart dospls49
Description
==37569==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6290005d1200 at pc 0x0000014bc6b9 bp 0x7fff8a573900 sp 0x7fff8a5730b0
WRITE of size 16384 at 0x6290005d1200 thread T0
    #0 0x14bc6b8 in __asan_memcpy /opt/media/clang_nightly/llvm/utils/release/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:466:3
    #1 0x9b3709e in cococart_slot_device::call_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/bus/coco/cococart.cpp:426:4
    #2 0x9b3731f in non-virtual thunk to cococart_slot_device::call_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/bus/coco/cococart.cpp
    #3 0xe108af6 in device_image_interface::finish_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/diimage.cpp:1163:11
    #4 0xe5686c8 in image_manager::postdevice_init() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/image.cpp:233:36
    #5 0xe1f0ca6 in driver_device::device_start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/driver.cpp:207:20
    #6 0x881c124 in coco_state::device_start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/machine/coco.cpp:131:17
    #7 0x8820e8d in coco12_state::device_start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/machine/coco12.cpp:20:14
    #8 0x882608c in d64plus_state::device_start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/machine/dragon.cpp:236:16
    #9 0xe0e345d in device_t::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/device.cpp:489:2
    #10 0xe6a1f65 in running_machine::start_all_devices() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:1040:13
    #11 0xe6a005d in running_machine::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:265:2
    #12 0xe6a2a41 in running_machine::run(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:310:3
    #13 0x8cd10e0 in mame_machine_manager::execute() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:236:19
    #14 0x8e1e0d3 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:257:22
    #15 0x8e20ee0 in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:273:3
    #16 0x8cd3717 in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:336:18
    #17 0x8acddf2 in main /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:216:9
    #18 0x7f1b81ff882f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291
    #19 0x1431838 in _start (/mnt/mame/mame64_as+0x1431838)

0x6290005d1200 is located 0 bytes to the right of 16384-byte region [0x6290005cd200,0x6290005d1200)
allocated by thread T0 here:
    #0 0x14fd722 in operator new(unsigned long) /opt/media/clang_nightly/llvm/utils/release/final/llvm.src/projects/compiler-rt/lib/asan/asan_new_delete.cc:92:3
    #1 0xe227b44 in allocate /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/ext/new_allocator.h:104:27
    #2 0xe227b44 in allocate /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/alloc_traits.h:491
    #3 0xe227b44 in _M_allocate /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_vector.h:170
    #4 0xe227b44 in _M_create_storage /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_vector.h:185
    #5 0xe227b44 in _Vector_base /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_vector.h:136
    #6 0xe227b44 in vector /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_vector.h:278
    #7 0xe227b44 in memory_region::memory_region(running_machine&, char const*, unsigned int, unsigned char, endianness_t) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem.cpp:4453
    #8 0xe1f8c6a in make_unique<memory_region, running_machine &, const char *&, unsigned int &, unsigned char &, endianness_t &> /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/unique_ptr.h:765:34
    #9 0xe1f8c6a in memory_manager::region_alloc(char const*, unsigned int, unsigned char, endianness_t) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem.cpp:1882
    #10 0xe7691fd in rom_load_manager::process_region_list() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/romload.cpp:1443:35
    #11 0xe76b8ef in rom_load_manager::rom_load_manager(running_machine&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/romload.cpp:1533:2
    #12 0xe69f947 in make_unique_clear<rom_load_manager, running_machine &> /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/corealloc.h:74:38
    #13 0xe69f947 in running_machine::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:238
    #14 0xe6a2a41 in running_machine::run(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:310:3
    #15 0x8cd10e0 in mame_machine_manager::execute() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:236:19
    #16 0x8e1e0d3 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:257:22
    #17 0x8e20ee0 in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:273:3
    #18 0x8cd3717 in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:336:18
    #19 0x8acddf2 in main /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:216:9
    #20 0x7f1b81ff882f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291

SUMMARY: AddressSanitizer: heap-buffer-overflow /opt/media/clang_nightly/llvm/utils/release/final/llvm.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:466:3 in __asan_memcpy
Shadow bytes around the buggy address:
  0x0c52800b21f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c52800b2200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c52800b2210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c52800b2220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c52800b2230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c52800b2240:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c52800b2250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c52800b2260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c52800b2270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c52800b2280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c52800b2290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
Steps To Reproduce
Additional Information
Github Commit
Flags
Regression Version
Affected Sets / Systems All dragon.cpp sets
Attached Files
 
Relationships
There are no relationship linked to this issue.
Notes
2
User avatar
No.16270
Pernod
Developer
Mar 24, 2019, 00:30
I believe this was fixed in https://github.com/mamedev/mame/commit/5299728ec343b902632474e224502ae172cba609
User avatar
No.16358
Pernod
Developer
Apr 23, 2019, 11:28
Fixed in 0.206.