Page MenuHome

Address Sanitizer reports read overrun in blender/windowmanager/intern/wm_operator_props.c
Closed, ResolvedPublic

Description

System Information
Operating system: Linux bertha 5.2.0-gentoo-bertha #1 SMP Sat Jul 13 21:34:03 EDT 2019 x86_64 Intel(R) Xeon(R) CPU E5-2630 v4 @ 2.20GHz GenuineIntel GNU/Linux
Graphics card: Radeon Pro WX 9100 (VEGA10, DRM 3.32.0, 5.2.0-gentoo-bertha, LLVM 7.1.0)

Blender Version
Broken: 2.81 (sub 5), Tue Sep 3 21:45:39 2019 +0200 commit 1af0f1fed9a680df6cdde9c2b220b5ddc9bf03e0 HEAD -> master

Short description of error
Address Sanitizer reporting a read overrun of eight bytes of a buffer; aborts blender.
Exact steps for others to reproduce the error

  1. Build a debug blender with Address Sanitizer enabled. i.e. 'make developer debug', specifically with cmake flag WITH_COMPILER_ASAN=ON
  2. Run blender. Address Sanitizer aborts on startup
  3. Run blender again. Now, preferably, in a debugger. See what's up (my notes on seeing what's up is below)

Blend file
Not triggered by a blend file - Can't get that far.
Address Sanitizer dump


Where the Plot Sickens
Stems from commit ee8f69c96cba62b083fb089432cddd0bce5d08e1
Author: Julian Eisel <eiseljulian@gmail.com>
Date: Tue Sep 3 15:43:38 2019 +0200

With that commit, a static const EnumPropertyItem file_action_types[] wm_operatorprops.c, line 81
lacking a terminating sentry record is defined and passed to RNA_def_enum(...) as an items buffer. See line 207, same file.
RNA_def_enum, failing to find the sentry record, reads past the buffer and Thus Offends The Address Sanitizer Gods.
To be picky, the overflow specifically takes place in rna_define.c:RNA_def_property_enum_items(...), called by RNA_def_enum(...)
See rna_define.c, line 1776

To keep RNA_def_property_enum_items(...) happy, methinks the enum file_action_type needs to be given a final sentry item filled with zero bytes. Template here:
rna_space.c line 419

@Julian Eisel (Severin), could you take a look, please. Take care!

Event Timeline

Ray Molenkamp (LazyDodo) lowered the priority of this task from 90 to 50.

Can't repro, no asan on windows, but looking at the code the problem is definitively there.