Viewing Issue Advanced Details
[ Jump to Notes ]
ID Category [?] Severity [?] Reproducibility Date Submitted Last Update
08512 Misc. Critical (emulator) Always Nov 10, 2022, 10:46 Jan 27, 2023, 13:50
Tester Firewave View Status Public Platform MAME (Self-compiled)
Assigned To Resolution Open OS Linux (64-bit)
Status [?] Acknowledged Driver
Version 0.249 Fixed in Version Build 64-bit
Fixed in Git Commit Github Pull Request #
Summary 08512: AddressSanitizer: heap-buffer-overflow with -video bgfx
Description 
==1493==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f35ef1f9800 at pc 0x7f362d859297 bp 0x7fffe21f8990 sp 0x7fffe21f8160
READ of size 386048 at 0x7f35ef1f9800 thread T0
    #0 0x7f362d859296 in __asan_memcpy (/mnt/s/GitHub/mame/mame+0x24de2296) (BuildId: 7b7aeda5846ab501)
    #1 0x7f365701702a in bx::memCopy(void*, void const*, unsigned long) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../3rdparty/bx/src/bx.cpp:43:3
    #2 0x7f3656df888c in bgfx::copy(void const*, unsigned int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../3rdparty/bgfx/src/bgfx.cpp:4024:3
    #3 0x7f365402ced1 in bgfx_util::mame_texture_data_to_bgfx_texture_data(bgfx::TextureFormat::Enum&, unsigned int, int, int, rgb_t const*, void*, unsigned short&, int&, int&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/modules/render/bgfxutil.cpp
    #4 0x7f3654036e55 in chain_manager::update_screen_textures(unsigned int, render_primitive*, osd_window&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/modules/render/bgfx/chainmanager.cpp:483:29
    #5 0x7f36540091ae in renderer_bgfx::draw(int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/modules/render/drawbgfx.cpp:875:35
    #6 0x7f36541007ee in sdl_window_info::update() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/window.cpp:627:17
    #7 0x7f3653f27333 in sdl_osd_interface::update(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/video.cpp:108:12
    #8 0x7f3653dd9c8d in video_manager::frame_update(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/video.cpp:238:18
    #9 0x7f3653cd0b78 in screen_device::vblank_begin(int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1646:21
    #10 0x7f3653cb96b4 in operator() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/delegate.h:765:11
    #11 0x7f3653cb96b4 in device_scheduler::execute_timers() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:951:5
    #12 0x7f3653cb45f8 in device_scheduler::timeslice() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:505:2
    #13 0x7f3653b51067 in running_machine::run(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:329:17
    #14 0x7f364bc60caf in mame_machine_manager::execute() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:290:19
    #15 0x7f364d018026 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:275:22
    #16 0x7f364d01bb6f in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:291:3
    #17 0x7f364bc65a8f in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:454:18
    #18 0x7f3653e470fb in main /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:191:9
    #19 0x7f3606b89209 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #20 0x7f3606b892bb in __libc_start_main csu/../csu/libc-start.c:389:3
    #21 0x7f362d7d7120 in _start (/mnt/s/GitHub/mame/mame+0x24d60120) (BuildId: 7b7aeda5846ab501)

0x7f35ef1f9800 is located 0 bytes to the right of 425984-byte region [0x7f35ef191800,0x7f35ef1f9800)
allocated by thread T0 here:
    #0 0x7f362d8950dd in operator new[](unsigned long, std::nothrow_t const&) (/mnt/s/GitHub/mame/mame+0x24e1e0dd) (BuildId: 7b7aeda5846ab501)
    #1 0x7f3655f58075 in bitmap_t::allocate(int, int, int, int) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/bitmap.cpp:242:17
    #2 0x7f3653cd0133 in screen_device::register_screen_bitmap(bitmap_t&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1627:9
    #3 0x7f3653ccc2a4 in screen_device::device_start() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:819:3
    #4 0x7f364d2c27d0 in device_t::start() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/device.cpp:562:2
    #5 0x7f3653b4fe9f in running_machine::start_all_devices() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:1013:13
    #6 0x7f3653b4de74 in running_machine::start() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:211:2
    #7 0x7f3653b50c9c in running_machine::run(bool) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:281:3
    #8 0x7f364bc60caf in mame_machine_manager::execute() /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:290:19
    #9 0x7f364d018026 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:275:22
    #10 0x7f364d01bb6f in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:291:3
    #11 0x7f364bc65a8f in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:454:18
    #12 0x7f3653e470fb in main /mnt/s/GitHub/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:191:9
    #13 0x7f3606b89209 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow (/mnt/s/GitHub/mame/mame+0x24de2296) (BuildId: 7b7aeda5846ab501) in __asan_memcpy
Shadow bytes around the buggy address:
  0x0fe73de372b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe73de372c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe73de372d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe73de372e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe73de372f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0fe73de37300:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe73de37310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe73de37320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe73de37330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe73de37340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0fe73de37350: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
Steps To Reproduce
Additional Information Affected sets:
pbobble3
pbobble4
krokha
a500
Github Commit
Flags
Regression Version
Affected Sets / Systems
Attached Files
  
Relationships
There are no relationship linked to this issue.
Notes
3
User avatar
No.20788
Firewave
Senior Tester
Nov 10, 2022, 10:46
edited on: Nov 10, 2022, 10:49
 This is based on running pbobble3.

READ of size 386048 at 0x7f72408f9800 thread T0

This message is quite misleading as it might indicate that the read of that size might start at that address - but it doesn't.

Adding logging to chain_manager::update_screen_textures() indicates it actually starts at 0x7f724089b4b8:
std::cout << full_name << " " << prim.m_rowpixels << " " << prim.m_tex_width << " " << tex_width << " " << prim.m_tex_height << " " << tex_height << " " << prim.m_prim->texture.width << " " << prim.m_prim->texture.height << " " << prim.m_prim->texture.base << std::endl;

source0 416 320 320 232 232 320 232 0x7f724089b4b8

This is inside a bitmap (logging from bitmap_t::allocate())
std::cout << "bitmap - " << m_width << " " << m_height << " " << m_rowpixels << " " << m_allocbytes << " " << xslop << " " << yslop << " " << (int)m_bpp << " " << m_format << " " << m_base << std::endl;

bitmap - 416 256 416 425984 0 0 32 5 0x7f7240891800

as correctly pointed out in ASAN as well:
0x7f72408f9800 is located 0 bytes to the right of 425984-byte region [0x7f7240891800,0x7f72408f9800)

The start address is calculated in render_texture::get_scaled()
std::cout << "render - " << texinfo.base << " " << m_sbounds.top() << " " << m_sbounds.left() << std::endl;

render - 0x7f724089b4b8 24 46

which is an offset of 40,120 which leaves 385,864 bytes in the bitmap but it wants to copy 386,048 bytes (a difference of 184) in bgfx_util::mame_texture_data_to_bgfx_texture_data()

std::cout << "TEXFORMAT_RGB32 - " << rowpixels << " " << height << " " << width_div_factor << " " << width_mul_factor << " " << out_pitch << " " << info.storageSize << std::endl;

TEXFORMAT_RGB32 - 416 232 1 1 1664 386048
User avatar
No.20812
Firewave
Senior Tester
Nov 14, 2022, 20:33
edited on: Nov 14, 2022, 20:34
 Given that the bitmap is 416x256 and it is using 416x232 for the texture it indicates the top bounds scaling is applied. But the left bounds of 46 appear to be missing in the calculation which would match the difference in the size - 184 bytes -> 46 * 4 bytes (32bit).
User avatar
No.21046
Tafoid
Administrator
Jan 27, 2023, 13:50
 @Firewave
I'm told there are fixes for these in the WIP on Mooglyguy's GitHub Repo
https://github.com/MooglyGuy/mame

Since he doesn't have a direct access to use Linux/ASAN, he cannot test appropriately to verify and asks for you or anyone who can take the adjusted code from his master branch and verify that this and 08512 no longer shows up.