06833: All einstein.cpp sets: AddressSanitizer: heap-buffer-overflow with -flop1 256games

ID	Category [?]	Severity [?]	Reproducibility	Date Submitted	Last Update
06833	Misc.	Critical (emulator)	Always	Jan 7, 2018, 17:19	Jun 15, 2020, 13:12

Tester	Firewave	View Status	Public	Platform
Assigned To	MetalliC	Resolution	Fixed	OS
Status [?]	Resolved			Driver	tatung/einstein.cpp
Version	0.193	Fixed in Version	0.222	Build
		Fixed in Git Commit		Github Pull Request #

Summary	06833: All einstein.cpp sets: AddressSanitizer: heap-buffer-overflow with -flop1 256games
Description	==48617==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000be050 at pc 0x00000e8f2f40 bp 0x7ffea47faf90 sp 0x7ffea47faf88 READ of size 8 at 0x6030000be050 thread T0 #0 0xe8f2f3f in clear /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_vector.h:1212:39 #1 0xe8f2f3f in floppy_image_format_t::generate_track_from_levels(int, int, std::vector<unsigned int, std::allocator<unsigned int> >&, int, floppy_image) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/flopimg.cpp:1759 #2 0xe8fefb0 in floppy_image_format_t::build_pc_track_mfm(int, int, floppy_image, int, int, floppy_image_format_t::desc_pc_sector const, int, int, int, int) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/flopimg.cpp:2766:2 #3 0xe8d1192 in dsk_format::load(io_generic, unsigned int, floppy_image) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/dsk_dsk.cpp:438:4 #4 0xc6d24cd in floppy_image_device::call_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/imagedev/floppy.cpp:428:20 #5 0xc6d317f in non-virtual thunk to floppy_image_device::call_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/imagedev/floppy.cpp #6 0xe108af6 in device_image_interface::finish_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/diimage.cpp:1163:11 #7 0xe5686c8 in image_manager::postdevice_init() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/image.cpp:233:36 #8 0xe1f0ca6 in driver_device::device_start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/driver.cpp:207:20 #9 0xe0e345d in device_t::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/device.cpp:489:2 #10 0xe6a1f65 in running_machine::start_all_devices() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:1040:13 #11 0xe6a005d in running_machine::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:265:2 #12 0xe6a2a41 in running_machine::run(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:310:3 #13 0x8cd10e0 in mame_machine_manager::execute() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:236:19 #14 0x8e1e0d3 in cli_frontend::start_execution(mame_machine_manager, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:257:22 #15 0x8e20ee0 in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:273:3 #16 0x8cd3717 in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:336:18 #17 0x8acddf2 in main /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:216:9 #18 0x7fec5d96782f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291 #19 0x1431838 in _start (/mnt/mame/mame64_as+0x1431838) 0x6030000be050 is located 0 bytes to the right of 32-byte region [0x6030000be030,0x6030000be050) allocated by thread T0 here: #0 0x14fd722 in operator new(unsigned long) /opt/media/clang_nightly/llvm/utils/release/final/llvm.src/projects/compiler-rt/lib/asan/asan_new_delete.cc:92:3 #1 0xe901636 in allocate /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/ext/new_allocator.h:104:27 #2 0xe901636 in allocate /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/alloc_traits.h:491 #3 0xe901636 in _M_allocate /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_vector.h:170 #4 0xe901636 in std::vector<floppy_image::track_info, std::allocator<floppy_image::track_info> >::_M_default_append(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/vector.tcc:557 #5 0xe8d9f20 in resize /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_vector.h:676:4 #6 0xe8d9f20 in floppy_image::floppy_image(int, int, unsigned int) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/formats/flopimg.cpp:905 #7 0xc6d2451 in floppy_image_device::call_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/imagedev/floppy.cpp:427:10 #8 0xc6d317f in non-virtual thunk to floppy_image_device::call_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/devices/imagedev/floppy.cpp #9 0xe108af6 in device_image_interface::finish_load() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/diimage.cpp:1163:11 #10 0xe5686c8 in image_manager::postdevice_init() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/image.cpp:233:36 #11 0xe1f0ca6 in driver_device::device_start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/driver.cpp:207:20 #12 0xe0e345d in device_t::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/device.cpp:489:2 #13 0xe6a1f65 in running_machine::start_all_devices() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:1040:13 #14 0xe6a005d in running_machine::start() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:265:2 #15 0xe6a2a41 in running_machine::run(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:310:3 #16 0x8cd10e0 in mame_machine_manager::execute() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:236:19 #17 0x8e1e0d3 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:257:22 #18 0x8e20ee0 in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:273:3 #19 0x8cd3717 in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:336:18 #20 0x8acddf2 in main /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:216:9 #21 0x7fec5d96782f in __libc_start_main /build/glibc-bfm8X4/glibc-2.23/csu/../csu/libc-start.c:291 SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/bits/stl_vector.h:1212:39 in clear Shadow bytes around the buggy address: 0x0c068000fbb0: fa fa fd fd fd fd fa fa 00 00 00 06 fa fa 00 00 0x0c068000fbc0: 07 fa fa fa 00 00 07 fa fa fa 00 00 07 fa fa fa 0x0c068000fbd0: 00 00 07 fa fa fa 00 00 07 fa fa fa 00 00 07 fa 0x0c068000fbe0: fa fa 00 00 00 01 fa fa 00 00 00 01 fa fa 00 00 0x0c068000fbf0: 00 01 fa fa 00 00 00 01 fa fa 00 00 00 01 fa fa =>0x0c068000fc00: 00 00 00 01 fa fa 00 00 00 00[fa]fa 00 00 00 00 0x0c068000fc10: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 0x0c068000fc20: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 0x0c068000fc30: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 0x0c068000fc40: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 0x0c068000fc50: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb
Steps To Reproduce
Additional Information
Github Commit

Flags
Regression Version
Affected Sets / Systems	All einstein.cpp sets

Attached Files

No.14640 Firewave Senior Tester Jan 9, 2018, 21:54 edited on: Jan 9, 2018, 21:56	The header of the image says it has 40 tracks and 2 heads, but the floppy_image object only contains 1 head. FYI: An Visual Studio debug build also asserts on this out of bounds access.
No.17746 Pernod Developer Jun 15, 2020, 13:12	Actually a bad dump as it should only contain 1 side. The DSK format has been updated to ignore sides that cannot be read by the floppy drive.