No.17383
Firewave Senior Tester
Feb 2, 2020, 10:06
edited on: Feb 2, 2020, 10:35
|
snespal -cart ranmagek
==21176==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x46151180 at pc 0x05cb0e44 bp 0x166fb79c sp 0x166fb790
WRITE of size 4 at 0x46151180 thread T0
#0 0x5cb0e43 in screen_device::create_composited_bitmap s:\dev\mame0217\src\emu\screen.cpp:1741
#1 0x5cb9441 in screen_device::update_quads s:\dev\mame0217\src\emu\screen.cpp:1768
#2 0x6146b76 in video_manager::finish_screen_updates s:\dev\mame0217\src\emu\video.cpp:863
#3 0x614709d in video_manager::frame_update s:\dev\mame0217\src\emu\video.cpp:217
#4 0x5cb99d2 in screen_device::vblank_begin s:\dev\mame0217\src\emu\screen.cpp:1660
#5 0x5cb1cf5 in screen_device::device_timer s:\dev\mame0217\src\emu\screen.cpp:959
#6 0x5fa7a0d in emu_timer::device_timer_expired s:\dev\mame0217\src\emu\schedule.cpp:317
#7 0x5fa80ac in device_scheduler::execute_timers s:\dev\mame0217\src\emu\schedule.cpp:907
#8 0x5fab12e in device_scheduler::timeslice s:\dev\mame0217\src\emu\schedule.cpp:544
#9 0x5fb9530 in running_machine::run s:\dev\mame0217\src\emu\machine.cpp:372
#10 0x6e59e64 in mame_machine_manager::execute S:\dev\mame0217\src\frontend\mame\mame.cpp:261
#11 0x6e79b2a in cli_frontend::start_execution S:\dev\mame0217\src\frontend\mame\clifront.cpp:267
#12 0x6e71754 in cli_frontend::execute S:\dev\mame0217\src\frontend\mame\clifront.cpp:283
#13 0x6e5ad79 in emulator_info::start_frontend S:\dev\mame0217\src\frontend\mame\mame.cpp:392
#14 0xa0f24ae in main s:\dev\mame0217\src\osd\windows\winmain.cpp:323
#15 0x9e96df8 in __scrt_common_main_seh d:\agent\_work\6\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#16 0x75d06358 in BaseThreadInitThunk+0x18 (C:\WINDOWS\System32\KERNEL32.DLL+0x6b816358)
#17 0x76f17b73 in RtlGetAppContainerNamedObjectPath+0xe3 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x4b2e7b73)
#18 0x76f17b43 in RtlGetAppContainerNamedObjectPath+0xb3 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x4b2e7b43)
0x46151180 is located 0 bytes to the right of 1702272-byte region [0x45fb1800,0x46151180)
allocated by thread T0 here:
#0 0xc728bd in operator new[] D:\agent\_work\6\s\src\vctools\crt\asan\llvm\compiler-rt\lib\asan\asan_new_delete.cc:102
#1 0x1c80fcb in bitmap_t::allocate s:\dev\mame0217\src\lib\util\bitmap.cpp:249
#2 0x1c819a7 in bitmap_t::resize s:\dev\mame0217\src\lib\util\bitmap.cpp:289
#3 0x5cb4f3a in screen_device::realloc_screen_bitmaps s:\dev\mame0217\src\emu\screen.cpp:1129
#4 0x5cb082a in screen_device::configure s:\dev\mame0217\src\emu\screen.cpp:1024
#5 0x7fb6a2f in snes_ppu_device::dynamic_res_change+0x24f (s:\dev\mame0217\mame.exe+0x7ff6a2f)
#6 0x7fbcd60 in snes_ppu_device::write+0xd60 (s:\dev\mame0217\mame.exe+0x7ffcd60)
#7 0x1bcfa98 in snes_state::snes_w_io+0x48 (s:\dev\mame0217\mame.exe+0x1c0fa98)
#8 0x1b8f70a in snes_console_state::snes20_hi_w+0x38a (s:\dev\mame0217\mame.exe+0x1bcf70a)
#9 0x1b8feab in snes_console_state::snes20_lo_w+0x9b (s:\dev\mame0217\mame.exe+0x1bcfeab)
#10 0xc7b99b in delegate_mfp::method_stub<brazehs<tpp2_noalu_state>,void,address_space &,unsigned int,unsigned char,unsigned char>+0x1b (s:\dev\mame0217\mame.exe+0xcbb99b)
#11 0x6158390 in handler_entry_write_delegate<0,0,0,emu::device_delegate<void __cdecl(address_space &,unsigned int,unsigned char,unsigned char)> >::write s:\dev\mame0217\src\emu\emumem_hedp.cpp:140
#12 0x699e170 in handler_entry_write_dispatch<24,0,0,0>::write s:\dev\mame0217\src\emu\emumem_hedw.ipp:52
#13 0x5f810b4 in address_space_specific<0,0,0>::write_native s:\dev\mame0217\src\emu\emumem.cpp:610
#14 0x5f7bdd4 in address_space_specific<0,0,1>::write_byte s:\dev\mame0217\src\emu\emumem.cpp:630
#15 0x7bc8c56 in g65816_device::g65816i_write_8_normal+0xe6 (s:\dev\mame0217\mame.exe+0x7c08c56)
#16 0x8e49cbf in g65816_device::g65816i_8d_E+0xdf (s:\dev\mame0217\mame.exe+0x8e89cbf)
#17 0x8e53315 in g65816_device::g65816i_execute_M1X1+0x335 (s:\dev\mame0217\mame.exe+0x8e93315)
#18 0x7bc6063 in g65816_device::execute_run+0x53 (s:\dev\mame0217\mame.exe+0x7c06063)
#19 0x5faacb7 in device_scheduler::timeslice s:\dev\mame0217\src\emu\schedule.cpp:495
#20 0x5fb9530 in running_machine::run s:\dev\mame0217\src\emu\machine.cpp:372
#21 0x6e59e64 in mame_machine_manager::execute S:\dev\mame0217\src\frontend\mame\mame.cpp:261
#22 0x6e79b2a in cli_frontend::start_execution S:\dev\mame0217\src\frontend\mame\clifront.cpp:267
#23 0x6e71754 in cli_frontend::execute S:\dev\mame0217\src\frontend\mame\clifront.cpp:283
#24 0x6e5ad79 in emulator_info::start_frontend S:\dev\mame0217\src\frontend\mame\mame.cpp:392
#25 0xa0f24ae in main s:\dev\mame0217\src\osd\windows\winmain.cpp:323
#26 0x9e96df8 in __scrt_common_main_seh d:\agent\_work\6\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#27 0x75d06358 in BaseThreadInitThunk+0x18 (C:\WINDOWS\System32\KERNEL32.DLL+0x6b816358)
SUMMARY: AddressSanitizer: heap-buffer-overflow s:\dev\mame0217\src\emu\screen.cpp:1741 in screen_device::create_composited_bitmap
Shadow bytes around the buggy address:
0x38c2a1e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x38c2a1f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x38c2a200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x38c2a210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x38c2a220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x38c2a230:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x38c2a240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x38c2a250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x38c2a260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x38c2a270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x38c2a280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==21176==ABORTING
snespal -cart aryol
==20324==ERROR: AddressSanitizer: negative-size-param: (size=-4)
#0 0xc622a8 in __asan_wrap_memmove D:\agent\_work\6\s\src\vctools\crt\asan\llvm\compiler-rt\lib\sanitizer_common\sanitizer_common_interceptors.inc:784
#1 0x5caf437 in screen_device::allocate_scan_bitmaps s:\dev\mame0217\src\emu\screen.cpp:666
#2 0x5cb50c2 in screen_device::realloc_screen_bitmaps s:\dev\mame0217\src\emu\screen.cpp:1140
#3 0x5cb082a in screen_device::configure s:\dev\mame0217\src\emu\screen.cpp:1024
#4 0x7fb6a2f in snes_ppu_device::dynamic_res_change+0x24f (s:\dev\mame0217\mame.exe+0x7ff6a2f)
#5 0x7fbcd60 in snes_ppu_device::write+0xd60 (s:\dev\mame0217\mame.exe+0x7ffcd60)
#6 0x1bcfa98 in snes_state::snes_w_io+0x48 (s:\dev\mame0217\mame.exe+0x1c0fa98)
#7 0x1b8f70a in snes_console_state::snes20_hi_w+0x38a (s:\dev\mame0217\mame.exe+0x1bcf70a)
#8 0xc7b99b in delegate_mfp::method_stub<brazehs<tpp2_noalu_state>,void,address_space &,unsigned int,unsigned char,unsigned char>+0x1b (s:\dev\mame0217\mame.exe+0xcbb99b)
#9 0x6158390 in handler_entry_write_delegate<0,0,0,emu::device_delegate<void __cdecl(address_space &,unsigned int,unsigned char,unsigned char)> >::write s:\dev\mame0217\src\emu\emumem_hedp.cpp:140
#10 0x699e170 in handler_entry_write_dispatch<24,0,0,0>::write s:\dev\mame0217\src\emu\emumem_hedw.ipp:52
#11 0x5f810b4 in address_space_specific<0,0,0>::write_native s:\dev\mame0217\src\emu\emumem.cpp:610
#12 0x5f7bdd4 in address_space_specific<0,0,1>::write_byte s:\dev\mame0217\src\emu\emumem.cpp:630
#13 0x7bc8c56 in g65816_device::g65816i_write_8_normal+0xe6 (s:\dev\mame0217\mame.exe+0x7c08c56)
#14 0x8e49cbf in g65816_device::g65816i_8d_E+0xdf (s:\dev\mame0217\mame.exe+0x8e89cbf)
#15 0x8e53315 in g65816_device::g65816i_execute_M1X1+0x335 (s:\dev\mame0217\mame.exe+0x8e93315)
#16 0x7bc6063 in g65816_device::execute_run+0x53 (s:\dev\mame0217\mame.exe+0x7c06063)
#17 0x5faacb7 in device_scheduler::timeslice s:\dev\mame0217\src\emu\schedule.cpp:495
#18 0x5fb9530 in running_machine::run s:\dev\mame0217\src\emu\machine.cpp:372
#19 0x6e59e64 in mame_machine_manager::execute S:\dev\mame0217\src\frontend\mame\mame.cpp:261
#20 0x6e79b2a in cli_frontend::start_execution S:\dev\mame0217\src\frontend\mame\clifront.cpp:267
#21 0x6e71754 in cli_frontend::execute S:\dev\mame0217\src\frontend\mame\clifront.cpp:283
#22 0x6e5ad79 in emulator_info::start_frontend S:\dev\mame0217\src\frontend\mame\mame.cpp:392
#23 0xa0f24ae in main s:\dev\mame0217\src\osd\windows\winmain.cpp:323
#24 0x9e96df8 in __scrt_common_main_seh d:\agent\_work\6\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
#25 0x75d06358 in BaseThreadInitThunk+0x18 (C:\WINDOWS\System32\KERNEL32.DLL+0x6b816358)
#26 0x76f17b73 in RtlGetAppContainerNamedObjectPath+0xe3 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x4b2e7b73)
#27 0x76f17b43 in RtlGetAppContainerNamedObjectPath+0xb3 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x4b2e7b43)
0x462cf7d4 is located 1876 bytes inside of 2844-byte region [0x462cf080,0x462cfb9c)
allocated by thread T0 here:
#0 0xc724cd in operator new D:\agent\_work\6\s\src\vctools\crt\asan\llvm\compiler-rt\lib\asan\asan_new_delete.cc:99
#1 0xc781f1 in std::_Allocate<8,std::_Default_allocate_traits,0>+0x71 (s:\dev\mame0217\mame.exe+0xcb81f1)
#2 0x5c15f5b in std::vector<char32_t,std::allocator<char32_t> >::_Emplace_reallocate<char32_t const &> C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.24.28314\include\vector:745
#3 0x5caf331 in screen_device::allocate_scan_bitmaps s:\dev\mame0217\src\emu\screen.cpp:651
#4 0x5cb50c2 in screen_device::realloc_screen_bitmaps s:\dev\mame0217\src\emu\screen.cpp:1140
#5 0x5cb082a in screen_device::configure s:\dev\mame0217\src\emu\screen.cpp:1024
#6 0x7fb6a2f in snes_ppu_device::dynamic_res_change+0x24f (s:\dev\mame0217\mame.exe+0x7ff6a2f)
#7 0x7fbcd60 in snes_ppu_device::write+0xd60 (s:\dev\mame0217\mame.exe+0x7ffcd60)
#8 0x1bcfa98 in snes_state::snes_w_io+0x48 (s:\dev\mame0217\mame.exe+0x1c0fa98)
#9 0x1b8f70a in snes_console_state::snes20_hi_w+0x38a (s:\dev\mame0217\mame.exe+0x1bcf70a)
#10 0x1b8feab in snes_console_state::snes20_lo_w+0x9b (s:\dev\mame0217\mame.exe+0x1bcfeab)
#11 0xc7b99b in delegate_mfp::method_stub<brazehs<tpp2_noalu_state>,void,address_space &,unsigned int,unsigned char,unsigned char>+0x1b (s:\dev\mame0217\mame.exe+0xcbb99b)
#12 0x6158390 in handler_entry_write_delegate<0,0,0,emu::device_delegate<void __cdecl(address_space &,unsigned int,unsigned char,unsigned char)> >::write s:\dev\mame0217\src\emu\emumem_hedp.cpp:140
#13 0x699e170 in handler_entry_write_dispatch<24,0,0,0>::write s:\dev\mame0217\src\emu\emumem_hedw.ipp:52
#14 0x5f810b4 in address_space_specific<0,0,0>::write_native s:\dev\mame0217\src\emu\emumem.cpp:610
#15 0x5f7bdd4 in address_space_specific<0,0,1>::write_byte s:\dev\mame0217\src\emu\emumem.cpp:630
#16 0x7bc8c56 in g65816_device::g65816i_write_8_normal+0xe6 (s:\dev\mame0217\mame.exe+0x7c08c56)
#17 0x8e4a843 in g65816_device::g65816i_9f_E+0xe3 (s:\dev\mame0217\mame.exe+0x8e8a843)
#18 0x8e501b5 in g65816_device::g65816i_execute_M1X0+0x335 (s:\dev\mame0217\mame.exe+0x8e901b5)
#19 0x7bc6063 in g65816_device::execute_run+0x53 (s:\dev\mame0217\mame.exe+0x7c06063)
#20 0x5faacb7 in device_scheduler::timeslice s:\dev\mame0217\src\emu\schedule.cpp:495
#21 0x5fb9530 in running_machine::run s:\dev\mame0217\src\emu\machine.cpp:372
#22 0x6e59e64 in mame_machine_manager::execute S:\dev\mame0217\src\frontend\mame\mame.cpp:261
#23 0x6e79b2a in cli_frontend::start_execution S:\dev\mame0217\src\frontend\mame\clifront.cpp:267
#24 0x6e71754 in cli_frontend::execute S:\dev\mame0217\src\frontend\mame\clifront.cpp:283
#25 0x6e5ad79 in emulator_info::start_frontend S:\dev\mame0217\src\frontend\mame\mame.cpp:392
#26 0xa0f24ae in main s:\dev\mame0217\src\osd\windows\winmain.cpp:323
#27 0x9e96df8 in __scrt_common_main_seh d:\agent\_work\6\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
SUMMARY: AddressSanitizer: negative-size-param D:\agent\_work\6\s\src\vctools\crt\asan\llvm\compiler-rt\lib\sanitizer_common\sanitizer_common_interceptors.inc:784 in __asan_wrap_memmove
==20324==ABORTING
|