Viewing Issue Advanced Details
[ Jump to Notes ]
exidy/starfire.cpp
ID Category [?] Severity [?] Reproducibility Date Submitted Last Update
08477 Misc. Critical (emulator) Always Nov 4, 2022, 12:57 Nov 4, 2022, 23:02
Tester Firewave View Status Public Platform MAME (Self-compiled)
Assigned To hap Resolution Fixed OS Linux (64-bit)
Status [?] Resolved Driver
exidy/starfire.cpp
Version 0.249 Fixed in Version 0.250 Build 64-bit
Fixed in Git Commit bcaed32 Github Pull Request #
Summary 08477: fireone: AddressSanitizer: stack-use-after-return
Description 
=================================================================
==16328==ERROR: AddressSanitizer: stack-use-after-return on address 0x7fb355fe6318 at pc 0x7fb37e440cb9 bp 0x7fffc2c54490 sp 0x7fffc2c54488
READ of size 4 at 0x7fb355fe6318 thread T0
    #0 0x7fb37e440cb8 in starfire_base_state::scanline_callback(int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/exidy/starfire_v.cpp:245:35
    #1 0x7fb39cb13304 in operator() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/delegate.h:765:11
    #2 0x7fb39cb13304 in device_scheduler::execute_timers() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:951:5
    #3 0x7fb39cb0e858 in device_scheduler::timeslice() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:505:2
    #4 0x7fb39c9a64a7 in running_machine::run(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:329:17
    #5 0x7fb39fb0cf7f in mame_machine_manager::execute() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:290:19
    #6 0x7fb39fd018d6 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:275:22
    #7 0x7fb39fd0541f in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:291:3
    #8 0x7fb39fb11d5f in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:454:18
    #9 0x7fb39cce858b in main /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:191:9
    #10 0x7fb35b1e9209 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #11 0x7fb35b1e92bb in __libc_start_main csu/../csu/libc-start.c:389:3
    #12 0x7fb37a472260 in _start (/mnt/s/GitHub/mame/mame+0x1d397260) (BuildId: 603d3d1c300651feb2a8e3ac6e9cb58d3f85e77b)

Address 0x7fb355fe6318 is located in stack of thread T0 at offset 280 in frame
    #0 0x7fb39cb020ff in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > util::string_format<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, char const (&) [12], char const*&, char const*&, unsigned int&, char const*&>(char const (&) [12], char const*&, char const*&, unsigned int&, char const*&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/strformat.h:1716

  This frame has 1 object(s):
    [32, 408) 'str' (line 1718) <== Memory access at offset 280 is inside this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-return /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/exidy/starfire_v.cpp:245:35 in starfire_base_state::scanline_callback(int)
Shadow bytes around the buggy address:
  0x0ff6eabf4c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff6eabf4c20: 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 00 00 f3 f3
  0x0ff6eabf4c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff6eabf4c40: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x0ff6eabf4c50: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
=>0x0ff6eabf4c60: f5 f5 f5[f5]f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x0ff6eabf4c70: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x0ff6eabf4c80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x0ff6eabf4c90: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x0ff6eabf4ca0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x0ff6eabf4cb0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==16328==ABORTING

Possibly caused by
../../../../../src/mame/exidy/starfire_v.cpp:245:35: runtime error: index 190 out of bounds for type 'pen_t[64]' (aka 'unsigned int[64]')
    #0 0x7f60e7ffa4e3 in starfire_base_state::scanline_callback(int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/exidy/starfire_v.cpp:245:35
    #1 0x7f61066cd304 in operator() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/delegate.h:765:11
    #2 0x7f61066cd304 in device_scheduler::execute_timers() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:951:5
    #3 0x7f61066c8858 in device_scheduler::timeslice() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:505:2
    #4 0x7f61065604a7 in running_machine::run(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:329:17
    #5 0x7f61096c6f7f in mame_machine_manager::execute() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:290:19
    #6 0x7f61098bb8d6 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:275:22
    #7 0x7f61098bf41f in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:291:3
    #8 0x7f61096cbd5f in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:454:18
    #9 0x7f61068a258b in main /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:191:9
    #10 0x7f60c4da9209 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #11 0x7f60c4da92bb in __libc_start_main csu/../csu/libc-start.c:389:3
    #12 0x7f60e402c260 in _start (/mnt/s/GitHub/mame/mame+0x1d397260) (BuildId: 603d3d1c300651feb2a8e3ac6e9cb58d3f85e77b)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../../../../src/mame/exidy/starfire_v.cpp:245:35 in
Steps To Reproduce
Additional Information
Github Commit
Flags
Regression Version
Affected Sets / Systems fireone
Attached Files
  
Relationships
There are no relationship linked to this issue.
Notes
2
User avatar
No.20716
hap
Developer
Nov 4, 2022, 19:52
 maybe fixed here: https://github.com/mamedev/mame/commit/bcaed327ff988ed945507036c5290e71fe7b48f8
User avatar
No.20721
Firewave
Senior Tester
Nov 4, 2022, 23:02
 Cherry-picked and fix confirmed.