taisei icon indicating copy to clipboard operation
taisei copied to clipboard

Use-after-free with TAISEI_NOPRELOAD=1

Open Akaricchi opened this issue 6 years ago • 0 comments

To reproduce, start a game and then go back to the title screen.

At least two things look wrong here: everything loads in transient mode (that's not what TAISEI_NOPRELOAD is for), and, obviously, the memory management bug which happens to be exposed by that.

3865      W: get_resource(): shader object 'texture_post_load.frag' was not preloaded
3866      I: finalize_resource(): Loaded shader object 'texture_post_load.frag' from '/tmp/taisei/share/taisei/00-taisei.zip/shader/texture_post_load.frag.glsl' (transient)
3866      I: finalize_resource(): Loaded shader program 'texture_post_load' from '/tmp/taisei/share/taisei/00-taisei.zip/shader/texture_post_load.prog' (transient)
=================================================================
==5255==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f000031c30 at pc 0x00000057da23 bp 0x7ffed06036d0 sp 0x7ffed06036c8
READ of size 4 at 0x60f000031c30 thread T0
    #0 0x57da22 in gl33_shader ../../../git/taisei/src/renderer/gl33/core.c:938
    #1 0x56f6d8 in r_shader_ptr ../../../git/taisei/src/renderer/api.c:367
    #2 0x5cb241 in texture_post_load ../../../git/taisei/src/resource/texture.c:308
    #3 0x5cb4df in load_texture_end ../../../git/taisei/src/resource/texture.c:331
    #4 0x5c2275 in load_resource_finish ../../../git/taisei/src/resource/resource.c:318
    #5 0x5c1d59 in load_resource ../../../git/taisei/src/resource/resource.c:285
    #6 0x5c267e in get_resource ../../../git/taisei/src/resource/resource.c:356
    #7 0x5c2bf1 in get_resource_data ../../../git/taisei/src/resource/resource.c:385
    #8 0x5cb548 in r_texture_get ../../../git/taisei/src/renderer/api.h:732
    #9 0x5cb548 in get_tex ../../../git/taisei/src/resource/texture.c:339
    #10 0x5cdaca in fill_screen ../../../git/taisei/src/resource/texture.c:507
    #11 0x51aa84 in draw_options_menu_bg ../../../git/taisei/src/menu/options.c:743
    #12 0x52c332 in draw_saverpy_menu ../../../git/taisei/src/menu/savereplay.c:47
    #13 0x513b7f in menu_render_frame ../../../git/taisei/src/menu/menu.c:171
    #14 0x4682d3 in loop_at_fps ../../../git/taisei/src/framerate.c:169
    #15 0x513c8e in menu_loop ../../../git/taisei/src/menu/menu.c:183
    #16 0x52e253 in ask_save_replay ../../../git/taisei/src/menu/savereplay.c:141
    #17 0x5047be in start_game_internal ../../../git/taisei/src/menu/common.c:93
    #18 0x5049cf in start_game ../../../git/taisei/src/menu/common.c:110
    #19 0x5122f5 in close_menu_finish ../../../git/taisei/src/menu/menu.c:60
    #20 0x4f6bb0 in call_callback ../../../git/taisei/src/transition.c:83
    #21 0x4f6fee in update_transition ../../../git/taisei/src/transition.c:146
    #22 0x5139cc in menu_logic_frame ../../../git/taisei/src/menu/menu.c:163
    #23 0x4680a2 in loop_at_fps ../../../git/taisei/src/framerate.c:157
    #24 0x513c8e in menu_loop ../../../git/taisei/src/menu/menu.c:183
    #25 0x49a6a1 in main ../../../git/taisei/src/main.c:314
    #26 0x7f593569cfea in __libc_start_main ../csu/libc-start.c:308
    #27 0x42c759 in _start (/data/taisei-build/dev/gcc/src/taisei+0x42c759)

0x60f000031c30 is located 0 bytes inside of 168-byte region [0x60f000031c30,0x60f000031cd8)
freed by thread T0 here:
    #0 0x7f5936ff8b50 in __interceptor_free ../../../../libsanitizer/asan/asan_malloc_linux.cc:66
    #1 0x58708e in gl33_shader_program_destroy ../../../git/taisei/src/renderer/gl33/shader_program.c:399
    #2 0x56f591 in r_shader_program_destroy ../../../git/taisei/src/renderer/api.c:354
    #3 0x5c6621 in unload_shader_program ../../../git/taisei/src/resource/shader_program.c:108
    #4 0x5c0703 in unload_resource ../../../git/taisei/src/resource/resource.c:166
    #5 0x5c440a in free_resources ../../../git/taisei/src/resource/resource.c:557
    #6 0x5047b9 in start_game_internal ../../../git/taisei/src/menu/common.c:92
    #7 0x5049cf in start_game ../../../git/taisei/src/menu/common.c:110
    #8 0x5122f5 in close_menu_finish ../../../git/taisei/src/menu/menu.c:60
    #9 0x4f6bb0 in call_callback ../../../git/taisei/src/transition.c:83
    #10 0x4f6fee in update_transition ../../../git/taisei/src/transition.c:146
    #11 0x5139cc in menu_logic_frame ../../../git/taisei/src/menu/menu.c:163
    #12 0x4680a2 in loop_at_fps ../../../git/taisei/src/framerate.c:157
    #13 0x513c8e in menu_loop ../../../git/taisei/src/menu/menu.c:183
    #14 0x49a6a1 in main ../../../git/taisei/src/main.c:314
    #15 0x7f593569cfea in __libc_start_main ../csu/libc-start.c:308

previously allocated by thread T0 here:
    #0 0x7f5936ff90b8 in __interceptor_calloc ../../../../libsanitizer/asan/asan_malloc_linux.cc:95
    #1 0x587127 in gl33_shader_program_link ../../../git/taisei/src/renderer/gl33/shader_program.c:403
    #2 0x56f52a in r_shader_program_link ../../../git/taisei/src/renderer/api.c:350
    #3 0x5c64e6 in load_shader_program_end ../../../git/taisei/src/resource/shader_program.c:94
    #4 0x5c2275 in load_resource_finish ../../../git/taisei/src/resource/resource.c:318
    #5 0x5c1d59 in load_resource ../../../git/taisei/src/resource/resource.c:285
    #6 0x5c267e in get_resource ../../../git/taisei/src/resource/resource.c:356
    #7 0x5c2bf1 in get_resource_data ../../../git/taisei/src/resource/resource.c:385
    #8 0x56dad9 in r_shader_get ../../../git/taisei/src/renderer/api.h:716
    #9 0x56dad9 in r_post_init ../../../git/taisei/src/renderer/api.c:70
    #10 0x499e42 in main ../../../git/taisei/src/main.c:242
    #11 0x7f593569cfea in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free ../../../git/taisei/src/renderer/gl33/core.c:938 in gl33_shader
Shadow bytes around the buggy address:
  0x0c1e7fffe330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1e7fffe340: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd
  0x0c1e7fffe350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c1e7fffe360: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c1e7fffe370: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
=>0x0c1e7fffe380: fa fa fa fa fa fa[fd]fd fd fd fd fd fd fd fd fd
  0x0c1e7fffe390: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c1e7fffe3a0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1e7fffe3b0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c1e7fffe3c0: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1e7fffe3d0: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==5255==ABORTING

Akaricchi avatar Oct 16 '18 14:10 Akaricchi