Skip to content

Segmentation fault when loading PC version #15

@donnyworks

Description

@donnyworks

Current system: Linux Mint

I built the PC version of the OpenBLOX rewrite, attempted to launch the game, and was disappointed when a simple "Segmentation Fault (core dumped)" showed up.

Building with -fsanitize=address showed me that the access violation (segmentation fault) lied in TinyPhysicsEngine's code.

==637372==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5170000013b4 at pc 0x584d3e1a929e bp 0x7fffcc9c2900 sp 0x7fffcc9c28f0
READ of size 12 at 0x5170000013b4 thread T0
    #0 0x584d3e1a929d in TPE_bodyInit(TPE_Body*, TPE_Joint*, unsigned char, TPE_Connection*, unsigned char, int) .././CoreEngine/./Node/../../ThirdParty/TinyPhysicsEngine/tinyphysicsengine.h:801
    #1 0x584d3e1cc048 in Part::makePhysicsPart() .././CoreEngine/./Node/nodes.h:128
    #2 0x584d3e1d6e93 in loadModelPartXML ../././rbxl.h:363
    #3 0x584d3e1d793c in loadModelPartXML ../././rbxl.h:439
    #4 0x584d3e1d7b4e in parseRBXMx(xml_document*) ../././rbxl.h:463
    #5 0x584d3e1d4c25 in parseRBXMf(_IO_FILE*, bool) ../././rbxl.h:74
    #6 0x584d3e1d7e9a in levelLoaderMenu(Node**, Node**, int, char**) .././Platform/PC/pc_function_loading.h:30
    #7 0x584d3e1d7bd4 in loadFiles(Node**, Node**, int, char**) ../././rbxl.h:486
    #8 0x584d3e1d8155 in main ../main.cpp:25
    #9 0x7f216c42a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #10 0x7f216c42a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #11 0x584d3e1a7ce4 in _start (/home/donovanb/Downloads/OpenBLOX-Complete-Rework/C_Engine/Makefiles/build_pc/main+0x8ce4) (BuildId: 980d0df6b1e73388f24f977018bc32171961d632)

0x5170000013b4 is located 3300 bytes after 720-byte region [0x517000000400,0x5170000006d0)
allocated by thread T0 here:
    #0 0x7f216ccfe548 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95
    #1 0x584d3e1d67a8 in loadModelPartXML ../././rbxl.h:353
    #2 0x584d3e1d793c in loadModelPartXML ../././rbxl.h:439
    #3 0x584d3e1d7b4e in parseRBXMx(xml_document*) ../././rbxl.h:463
    #4 0x584d3e1d4c25 in parseRBXMf(_IO_FILE*, bool) ../././rbxl.h:74
    #5 0x584d3e1d7e9a in levelLoaderMenu(Node**, Node**, int, char**) .././Platform/PC/pc_function_loading.h:30
    #6 0x584d3e1d7bd4 in loadFiles(Node**, Node**, int, char**) ../././rbxl.h:486
    #7 0x584d3e1d8155 in main ../main.cpp:25
    #8 0x7f216c42a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #9 0x7f216c42a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #10 0x584d3e1a7ce4 in _start (/home/donovanb/Downloads/OpenBLOX-Complete-Rework/C_Engine/Makefiles/build_pc/main+0x8ce4) (BuildId: 980d0df6b1e73388f24f977018bc32171961d632)

SUMMARY: AddressSanitizer: heap-buffer-overflow .././CoreEngine/./Node/../../ThirdParty/TinyPhysicsEngine/tinyphysicsengine.h:801 in TPE_bodyInit(TPE_Body*, TPE_Joint*, unsigned char, TPE_Connection*, unsigned char, int)
Shadow bytes around the buggy address:
  0x517000001100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x517000001380: fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa
  0x517000001400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==637372==ABORTING
donovanb@donovansrealpc:~/Downloads/OpenBLOX-Complete-Rework/C_Engine/Makefiles/build_pc$ ./main | echo run.log
run.log
=================================================================
==637374==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5170000013b4 at pc 0x60c533f2829e bp 0x7fff1f52c100 sp 0x7fff1f52c0f0
READ of size 12 at 0x5170000013b4 thread T0
    #0 0x60c533f2829d in TPE_bodyInit(TPE_Body*, TPE_Joint*, unsigned char, TPE_Connection*, unsigned char, int) .././CoreEngine/./Node/../../ThirdParty/TinyPhysicsEngine/tinyphysicsengine.h:801
    #1 0x60c533f4b048 in Part::makePhysicsPart() .././CoreEngine/./Node/nodes.h:128
    #2 0x60c533f55e93 in loadModelPartXML ../././rbxl.h:363
    #3 0x60c533f5693c in loadModelPartXML ../././rbxl.h:439
    #4 0x60c533f56b4e in parseRBXMx(xml_document*) ../././rbxl.h:463
    #5 0x60c533f53c25 in parseRBXMf(_IO_FILE*, bool) ../././rbxl.h:74
    #6 0x60c533f56e9a in levelLoaderMenu(Node**, Node**, int, char**) .././Platform/PC/pc_function_loading.h:30
    #7 0x60c533f56bd4 in loadFiles(Node**, Node**, int, char**) ../././rbxl.h:486
    #8 0x60c533f57155 in main ../main.cpp:25
    #9 0x79ed9b02a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #10 0x79ed9b02a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #11 0x60c533f26ce4 in _start (/home/donovanb/Downloads/OpenBLOX-Complete-Rework/C_Engine/Makefiles/build_pc/main+0x8ce4) (BuildId: 980d0df6b1e73388f24f977018bc32171961d632)

0x5170000013b4 is located 3300 bytes after 720-byte region [0x517000000400,0x5170000006d0)
allocated by thread T0 here:
    #0 0x79ed9b8fe548 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95
    #1 0x60c533f557a8 in loadModelPartXML ../././rbxl.h:353
    #2 0x60c533f5693c in loadModelPartXML ../././rbxl.h:439
    #3 0x60c533f56b4e in parseRBXMx(xml_document*) ../././rbxl.h:463
    #4 0x60c533f53c25 in parseRBXMf(_IO_FILE*, bool) ../././rbxl.h:74
    #5 0x60c533f56e9a in levelLoaderMenu(Node**, Node**, int, char**) .././Platform/PC/pc_function_loading.h:30
    #6 0x60c533f56bd4 in loadFiles(Node**, Node**, int, char**) ../././rbxl.h:486
    #7 0x60c533f57155 in main ../main.cpp:25
    #8 0x79ed9b02a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #9 0x79ed9b02a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #10 0x60c533f26ce4 in _start (/home/donovanb/Downloads/OpenBLOX-Complete-Rework/C_Engine/Makefiles/build_pc/main+0x8ce4) (BuildId: 980d0df6b1e73388f24f977018bc32171961d632)

SUMMARY: AddressSanitizer: heap-buffer-overflow .././CoreEngine/./Node/../../ThirdParty/TinyPhysicsEngine/tinyphysicsengine.h:801 in TPE_bodyInit(TPE_Body*, TPE_Joint*, unsigned char, TPE_Connection*, unsigned char, int)
Shadow bytes around the buggy address:
  0x517000001100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x517000001380: fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa
  0x517000001400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x517000001600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==637374==ABORTING```

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions