08512: AddressSanitizer: heap-buffer-overflow with -video bgfx

ID	Category [?]	Severity [?]	Reproducibility	Date Submitted	Last Update
08512	Misc.	Critical (emulator)	Always	Nov 10, 2022, 10:46	1 day ago

Tester	Firewave	View Status	Public	Platform	MAME (Self-compiled)
Assigned To	Ryan Holtz	Resolution	Fixed	OS	Linux (64-bit)
Status [?]	Resolved			Driver
Version	0.249	Fixed in Version	0.252	Build	64-bit
		Fixed in Git Commit	5671484	Github Pull Request #

Summary	08512: AddressSanitizer: heap-buffer-overflow with -video bgfx
Description	==1493==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f35ef1f9800 at pc 0x7f362d859297 bp 0x7fffe21f8990 sp 0x7fffe21f8160 READ of size 386048 at 0x7f35ef1f9800 thread T0 #0 0x7f362d859296 in __asan_memcpy (/mnt/s/GitHub/mame/mame+0x24de2296) (BuildId: 7b7aeda5846ab501) #1 0x7f365701702a in bx::memCopy(void, void const, unsigned long) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../3rdparty/bx/src/bx.cpp:43:3 #2 0x7f3656df888c in bgfx::copy(void const, unsigned int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../3rdparty/bgfx/src/bgfx.cpp:4024:3 #3 0x7f365402ced1 in bgfx_util::mame_texture_data_to_bgfx_texture_data(bgfx::TextureFormat::Enum&, unsigned int, int, int, rgb_t const, void, unsigned short&, int&, int&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/modules/render/bgfxutil.cpp #4 0x7f3654036e55 in chain_manager::update_screen_textures(unsigned int, render_primitive, osd_window&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/modules/render/bgfx/chainmanager.cpp:483:29 #5 0x7f36540091ae in renderer_bgfx::draw(int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/modules/render/drawbgfx.cpp:875:35 #6 0x7f36541007ee in sdl_window_info::update() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/window.cpp:627:17 #7 0x7f3653f27333 in sdl_osd_interface::update(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/video.cpp:108:12 #8 0x7f3653dd9c8d in video_manager::frame_update(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/video.cpp:238:18 #9 0x7f3653cd0b78 in screen_device::vblank_begin(int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1646:21 #10 0x7f3653cb96b4 in operator() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/delegate.h:765:11 #11 0x7f3653cb96b4 in device_scheduler::execute_timers() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:951:5 #12 0x7f3653cb45f8 in device_scheduler::timeslice() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:505:2 #13 0x7f3653b51067 in running_machine::run(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:329:17 #14 0x7f364bc60caf in mame_machine_manager::execute() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:290:19 #15 0x7f364d018026 in cli_frontend::start_execution(mame_machine_manager, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:275:22 #16 0x7f364d01bb6f in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:291:3 #17 0x7f364bc65a8f in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:454:18 #18 0x7f3653e470fb in main /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:191:9 #19 0x7f3606b89209 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #20 0x7f3606b892bb in __libc_start_main csu/../csu/libc-start.c:389:3 #21 0x7f362d7d7120 in _start (/mnt/s/GitHub/mame/mame+0x24d60120) (BuildId: 7b7aeda5846ab501) 0x7f35ef1f9800 is located 0 bytes to the right of 425984-byte region [0x7f35ef191800,0x7f35ef1f9800) allocated by thread T0 here: #0 0x7f362d8950dd in operator new[](unsigned long, std::nothrow_t const&) (/mnt/s/GitHub/mame/mame+0x24e1e0dd) (BuildId: 7b7aeda5846ab501) #1 0x7f3655f58075 in bitmap_t::allocate(int, int, int, int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/bitmap.cpp:242:17 #2 0x7f3653cd0133 in screen_device::register_screen_bitmap(bitmap_t&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1627:9 #3 0x7f3653ccc2a4 in screen_device::device_start() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:819:3 #4 0x7f364d2c27d0 in device_t::start() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/device.cpp:562:2 #5 0x7f3653b4fe9f in running_machine::start_all_devices() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:1013:13 #6 0x7f3653b4de74 in running_machine::start() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:211:2 #7 0x7f3653b50c9c in running_machine::run(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:281:3 #8 0x7f364bc60caf in mame_machine_manager::execute() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:290:19 #9 0x7f364d018026 in cli_frontend::start_execution(mame_machine_manager, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:275:22 #10 0x7f364d01bb6f in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:291:3 #11 0x7f364bc65a8f in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:454:18 #12 0x7f3653e470fb in main /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:191:9 #13 0x7f3606b89209 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 SUMMARY: AddressSanitizer: heap-buffer-overflow (/mnt/s/GitHub/mame/mame+0x24de2296) (BuildId: 7b7aeda5846ab501) in __asan_memcpy Shadow bytes around the buggy address: 0x0fe73de372b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0fe73de372c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0fe73de372d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0fe73de372e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0fe73de372f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0fe73de37300:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0fe73de37310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0fe73de37320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0fe73de37330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0fe73de37340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0fe73de37350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb
Steps To Reproduce
Additional Information	Affected sets: pbobble3 pbobble4 krokha a500
Github Commit

Flags
Regression Version
Affected Sets / Systems

Attached Files

No.20788 Firewave Senior Tester Nov 10, 2022, 10:46 edited on: Nov 10, 2022, 10:49	This is based on running pbobble3. READ of size 386048 at 0x7f72408f9800 thread T0 This message is quite misleading as it might indicate that the read of that size might start at that address - but it doesn't. Adding logging to chain_manager::update_screen_textures() indicates it actually starts at 0x7f724089b4b8: std::cout << full_name << " " << prim.m_rowpixels << " " << prim.m_tex_width << " " << tex_width << " " << prim.m_tex_height << " " << tex_height << " " << prim.m_prim->texture.width << " " << prim.m_prim->texture.height << " " << prim.m_prim->texture.base << std::endl; source0 416 320 320 232 232 320 232 0x7f724089b4b8 This is inside a bitmap (logging from bitmap_t::allocate()) std::cout << "bitmap - " << m_width << " " << m_height << " " << m_rowpixels << " " << m_allocbytes << " " << xslop << " " << yslop << " " << (int)m_bpp << " " << m_format << " " << m_base << std::endl; bitmap - 416 256 416 425984 0 0 32 5 0x7f7240891800 as correctly pointed out in ASAN as well: 0x7f72408f9800 is located 0 bytes to the right of 425984-byte region [0x7f7240891800,0x7f72408f9800) The start address is calculated in render_texture::get_scaled() std::cout << "render - " << texinfo.base << " " << m_sbounds.top() << " " << m_sbounds.left() << std::endl; render - 0x7f724089b4b8 24 46 which is an offset of 40,120 which leaves 385,864 bytes in the bitmap but it wants to copy 386,048 bytes (a difference of 184) in bgfx_util::mame_texture_data_to_bgfx_texture_data() std::cout << "TEXFORMAT_RGB32 - " << rowpixels << " " << height << " " << width_div_factor << " " << width_mul_factor << " " << out_pitch << " " << info.storageSize << std::endl; TEXFORMAT_RGB32 - 416 232 1 1 1664 386048
No.20812 Firewave Senior Tester Nov 14, 2022, 20:33 edited on: Nov 14, 2022, 20:34	Given that the bitmap is 416x256 and it is using 416x232 for the texture it indicates the top bounds scaling is applied. But the left bounds of 46 appear to be missing in the calculation which would match the difference in the size - 184 bytes -> 46 * 4 bytes (32bit).
No.21046 Tafoid Administrator Jan 27, 2023, 13:50	@Firewave I'm told there are fixes for these in the WIP on Mooglyguy's GitHub Repo https://github.com/MooglyGuy/mame Since he doesn't have a direct access to use Linux/ASAN, he cannot test appropriately to verify and asks for you or anyone who can take the adjusted code from his master branch and verify that this and 08512 no longer shows up.
No.22645 Firewave Senior Tester 1 day ago	I tried all the sets I listed in 0.272 with the vulkan and opengl BGFX backends and no issues using ASAN.
No.22647 Firewave Senior Tester 1 day ago edited on: 1 day ago	I am not 100% sure but this seems to indicate that it is not using the `vulkan` backend even if explicitly enabled and fallback to opengl instead. vulkan: No DRI3 support detected - required for presentation Note: you can probably enable DRI3 in your Xorg config libEGL warning: DRI3: Screen seems not DRI3 capable libEGL warning: DRI2: failed to authenticate libEGL warning: DRI3: Screen seems not DRI3 capable So I might have only tested the opengl backend but that was probably also the case when I filed my initial report.