Viewing Issue Advanced Details
ID Category [?] Severity [?] Reproducibility Date Submitted Last Update
08177 Crash/Freeze Critical (emulator) Always Jan 9, 2022, 17:44 19 days ago
Tester Kale View Status Public Platform MAME (Official Binary)
Assigned To Resolution Open OS Windows 10/11 (64-bit)
Status [?] Confirmed Driver
Version 0.239 Fixed in Version Build 64-bit
Fixed in Git Commit Github Pull Request #
Summary 08177: wwfroyal: Crashes MAME when entering game test mode
Description WWF Royal Rumble crashes MAME with a meaningless stack trace when entering in game test mode.
It will load that for a bit with a black screen then punts.
Steps To Reproduce Press F2 when NAOMI logo appears;
Press '9' until game test mode is highlighted;
Press F2 to enter into game test mode, wait until game crashes;
Additional Information It seems to access a bit of naomi_m2_board::read_callback fn before crashing, which isn't consistent (i.e. same NVRAM/.inp doesn't give same results on different runs) and may not be the culprit.
Stack trace is so meaningless that it may "eat" letters when dumping (i.e. "xptio at P000000010fb9 (ot fo): ACC VAT\nWhi attptig to ra ory at")
Github Commit
Flags
Regression Version
Affected Sets / Systems wwfroyal
Attached Files
png file icon 0005.png (3,449 bytes) Jan 9, 2022, 17:45 Uploaded by Kale
Kale
Relationships
There are no relationship linked to this issue.
Notes
3
User avatar
No.19668
Kale
Developer
Jan 9, 2022, 17:44
edited on: Jan 9, 2022, 17:44
Tested back to 0.190, where this still happens.
User avatar
No.19671
Kale
Developer
Jan 10, 2022, 17:31
edited on: Jan 10, 2022, 17:32
Robbbert managed to find that this crash specifically happens at https://github.com/mamedev/mame/blob/e13b47e557a2c9e7728f6565d6378b623610f414/src/mame/machine/315-5881_crypt.cpp#L961

Specifically that the line_buffer_size check
for(int i=0; i != line_buffer_size;) {

should be a < instead of a !=

We are not sure about how safe it is tho ...
User avatar
No.20817
Firewave
Senior Tester
19 days ago
edited on: 18 days ago
The set is marked as MNW.

0.249 on Linux reports (the allocation trace is not symbolized since the symbolizer ran out of memory):
==21350==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000645c81 at pc 0x7f1bc0bd635a bp 0x7fffd7025a50 sp 0x7fffd7025a48
WRITE of size 1 at 0x615000645c81 thread T0
    #0 0x7f1bc0bd6359 in sega_315_5881_crypt_device::line_fill() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/sega/315-5881_crypt.cpp:999:18
    #1 0x7f1bc0bd3e6b in sega_315_5881_crypt_device::do_decrypt(unsigned char*&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/sega/315-5881_crypt.cpp:185:4
    #2 0x7f1bc0dc9d5c in naomi_m2_board::board_get_buffer(unsigned char*&, unsigned int&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/sega/naomim2.cpp:149:19
    #3 0x7f1bc0d8092d in naomi_board::rom_data_r() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/sega/naomibd.cpp:155:2
    #4 0x7f1bd4fb8995 in operator() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/delegate.h:765:11
    #5 0x7f1bd4fb8995 in std::enable_if<(((std::is_same<emu::device_delegate<unsigned short ()>, emu::device_delegate<unsigned char ()> >::value) || (std::is_same<emu::device_delegate<unsigned short ()>, emu::device_delegate<unsigned short ()> >::value)) || (std::is_same<emu::device_delegate<unsigned short ()>, emu::device_delegate<unsigned int ()> >::value)) || (std::is_same<emu::device_delegate<unsigned short ()>, emu::device_delegate<unsigned long ()> >::value), unsigned short>::type handler_entry_read_delegate<1, -1, emu::device_delegate<unsigned short ()> >::read_impl<emu::device_delegate<unsigned short ()> >(unsigned int, unsigned short) const /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem_hedp.cpp:65:9
    #6 0x7f1bd4fb88f0 in handler_entry_read_delegate<1, -1, emu::device_delegate<unsigned short ()> >::read(unsigned int, unsigned short) const /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem_hedp.cpp:70:9
    #7 0x7f1bd9b5b165 in handler_entry_read_units<3, 0>::read(unsigned int, unsigned long) const /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem_heu.cpp:92:74
    #8 0x7f1bd4a10920 in emu::detail::handler_entry_size<3>::uX dispatch_read<0, 3, 0>(unsigned int, unsigned int, emu::detail::handler_entry_size<3>::uX, handler_entry_read<3, 0> const* const*) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem.h:1570:47
    #9 0x7f1bd5e9d548 in handler_entry_read_dispatch<14, 3, 0>::read(unsigned int, unsigned long) const /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem_hedr.ipp:132:9
    #10 0x7f1bd4acd600 in emu::detail::handler_entry_size<3>::uX dispatch_read<1, 3, 0>(unsigned int, unsigned int, emu::detail::handler_entry_size<3>::uX, handler_entry_read<3, 0> const* const*) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem.h:1570:47
    #11 0x7f1bd4acd4ad in address_space_specific<1, 3, 0, (util::endianness)0>::read_native(unsigned int, unsigned long) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem_aspace.cpp:433:10
    #12 0x7f1bd4a8097f in operator() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem_aspace.cpp:454:86
    #13 0x7f1bd4a8097f in memory_read_generic<3, 0, util::endianness::little, 2, true, (lambda at ../../../../../src/emu/emumem_aspace.cpp:454:24)> /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem.h:797:11
    #14 0x7f1bd4a8097f in address_space_specific<1, 3, 0, (util::endianness)0>::read_dword(unsigned int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/emumem_aspace.cpp:463:125
    #15 0x7f1b73adf515  (/dev/zero+0xe0515)

0x615000645c81 is located 1 bytes to the right of 512-byte region [0x615000645a80,0x615000645c80)
allocated by thread T0 here:
    #0 0x7f1bb439b97d  (/mnt/s/GitHub/mame/mame+0x24e1d97d) (BuildId: 5ea94812d72bae4c)
    #1 0x7f1bc0bd1d7d  (/mnt/s/GitHub/mame/mame+0x31653d7d) (BuildId: 5ea94812d72bae4c)
    #2 0x7f1bd3dc8790  (/mnt/s/GitHub/mame/mame+0x4484a790) (BuildId: 5ea94812d72bae4c)
    #3 0x7f1bda655e5f  (/mnt/s/GitHub/mame/mame+0x4b0d7e5f) (BuildId: 5ea94812d72bae4c)
    #4 0x7f1bda653e34  (/mnt/s/GitHub/mame/mame+0x4b0d5e34) (BuildId: 5ea94812d72bae4c)
    #5 0x7f1bda656c5c  (/mnt/s/GitHub/mame/mame+0x4b0d8c5c) (BuildId: 5ea94812d72bae4c)
    #6 0x7f1bd2766c6f  (/mnt/s/GitHub/mame/mame+0x431e8c6f) (BuildId: 5ea94812d72bae4c)
    #7 0x7f1bd3b1dfe6  (/mnt/s/GitHub/mame/mame+0x4459ffe6) (BuildId: 5ea94812d72bae4c)
    #8 0x7f1bd3b21b2f  (/mnt/s/GitHub/mame/mame+0x445a3b2f) (BuildId: 5ea94812d72bae4c)
    #9 0x7f1bd276ba4f  (/mnt/s/GitHub/mame/mame+0x431eda4f) (BuildId: 5ea94812d72bae4c)
    #10 0x7f1bda94cd0b  (/mnt/s/GitHub/mame/mame+0x4b3ced0b) (BuildId: 5ea94812d72bae4c)
    #11 0x7f1b8d689209  (/lib/x86_64-linux-gnu/libc.so.6+0x29209) (BuildId: 48b7efd5cbf9d6337df8a48de709d1f6f68f368e)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/mnt/s/GitHub/mame/mame+0x31658359) (BuildId: 5ea94812d72bae4c)
Shadow bytes around the buggy address:
  0x0c2a800c0b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2a800c0b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a800c0b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a800c0b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a800c0b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2a800c0b90:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2a800c0ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a800c0bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a800c0bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a800c0bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2a800c0be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb