Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[0.4.x] Plugin "gforce": heap-use-after-free in method PixPort::Fade #261

Open
hartwork opened this issue Feb 6, 2023 · 0 comments
Open

Comments

@hartwork
Copy link
Member

hartwork commented Feb 6, 2023

I ran into this unfixed heap-use-after-free today:

[..]
Switching to actor 'gforce'...
=================================================================
==32059==ERROR: AddressSanitizer: heap-use-after-free on address 0x7fc836f480ac at pc 0x7fc8457252c9 bp 0x7fff991274d0 sp 0x7fff991274c0
READ of size 1 at 0x7fc836f480ac thread T0
    #0 0x7fc8457252c8 in PixPort::Fade(char const*, char*, int, int, int, unsigned int*) [..]/libvisual-plugins/plugins/actor/G-Force/Common/UI/PixPort.cpp:933
    #1 0x7fc845705657 in PixPort::Fade(PixPort&, DeltaFieldData*) ../../../../plugins/actor/G-Force/Common/UI/Headers/PixPort.h:166
    #2 0x7fc845705657 in GForce::RecordSample(long) [..]/libvisual-plugins/plugins/actor/G-Force/GForceCommon/G-Force.cpp:926
    #3 0x7fc8457065f9 in GForce::RecordSample(long, float*, float, long, float*, float, long) [..]/libvisual-plugins/plugins/actor/G-Force/GForceCommon/G-Force.cpp:891
    #4 0x7fc845735366 in lv_gforce_render [..]/libvisual-plugins/plugins/actor/G-Force/unix/libvisual/actor_gforce.cpp:264
    #5 0x7fc84929dce4 in visual_actor_run [..]/libvisual/libvisual/lv_actor.c:774
    #6 0x7fc8492a3af7 in visual_bin_run [..]/libvisual/libvisual/lv_bin.c:867
    #7 0x55ba5dffc6f3 in LV::Bin::run() [..]/libvisual/tools/lv-tool/lv-tool.cpp:111
    #8 0x55ba5dffc6f3 in main [..]/libvisual/tools/lv-tool/lv-tool.cpp:936
    #9 0x7fc848d7d209  (/lib64/libc.so.6+0x2a209)
    #10 0x7fc848d7d2bb in __libc_start_main (/lib64/libc.so.6+0x2a2bb)
    #11 0x55ba5dff9890 in _start ([..]/INSTALL_PREFIX/bin/lv-tool-0.4+0x5890)

0x7fc836f480ac is located 39084 bytes inside of 269280-byte region [0x7fc836f3e800,0x7fc836f803e0)
freed by thread T0 here:
    #0 0x7fc8493ff5df in __interceptor_free /var/tmp/portage/sys-devel/gcc-11.3.1_p20230120-r1/work/gcc-11-20230120/libsanitizer/asan/asan_malloc_linux.cpp:127
    #1 0x7fc8421ed3f3  (/usr/lib64/dri/crocus_dri.so+0x1213f3)

previously allocated by thread T0 here:
    #0 0x7fc84940060a in __interceptor_posix_memalign /var/tmp/portage/sys-devel/gcc-11.3.1_p20230120-r1/work/gcc-11-20230120/libsanitizer/asan/asan_malloc_linux.cpp:226
    #1 0x7fc8421ec448  (/usr/lib64/dri/crocus_dri.so+0x120448)

SUMMARY: AddressSanitizer: heap-use-after-free [..]/libvisual-plugins/plugins/actor/G-Force/Common/UI/PixPort.cpp:933 in PixPort::Fade(char const*, char*, int, int, int, unsigned int*)
Shadow bytes around the buggy address:
  0x0ff986de0fc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff986de0fd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff986de0fe0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff986de0ff0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff986de1000: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0ff986de1010: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
  0x0ff986de1020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff986de1030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff986de1040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff986de1050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0ff986de1060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==32059==ABORTING
@hartwork hartwork added the bug label Feb 6, 2023
@hartwork hartwork changed the title [0.4.x] heap-use-after-free in method PixPort::Fade of actor "gforce" [0.4.x] Plugin "gforce": heap-use-after-free in method PixPort::Fade Feb 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant