HaxeFoundation / HaxeFoundation/hxcpp

Allocating a huge string causes heap corruption

Open
#986 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
330
Forks
227
Avg merge
2d 16h
Merged PRs (30d)
18

Description

I'm trying to compile an openfl application for the Windows target but am encountering heap corruption.

The swf loader tries to parse out a huge json string (4.4 million characters wide) with haxe's `JsonParser` and it eventually corrupts the heap, in `GlobalAllocator::AllocMoreBlocks`. This is the stack at the point the memory I watched was overwritten:

```
ApplicationMain-debug.exe!memset_repmovs() Line 67 Unknown
ApplicationMain-debug.exe!BlockDataInfo::clear() Line 779 C++
ApplicationMain-debug.exe!BlockDataInfo::BlockDataInfo(int inGid, BlockData * inData) Line 770 C++
ApplicationMain-debug.exe!GlobalAllocator::AllocMoreBlocks(bool & outForceCompact, bool inJustBorrowing) Line 3445 C++
ApplicationMain-debug.exe!GlobalAllocator::GetFreeBlock(int inRequiredBytes, hx::ImmixAllocator * inAlloc) Line 3523 C++
ApplicationMain-debug.exe!LocalAllocator::CallAlloc(int inSize, unsigned int inObjectFlags) Line 6156 C++
ApplicationMain-debug.exe!hx::InternalNew(int inSize, bool inIsObject) Line 6487 C++
> ApplicationMain-debug.exe!hx::NewString(int inLen) Line 116 C++
ApplicationMain-debug.exe!GCStringDup(const char * inStr, int inLen, int * outLen) Line 420 C++
ApplicationMain-debug.exe!String::substr(int inFirst, Dynamic inLen) Line 1982 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseString() Line 638 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 356 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 252 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 372 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 252 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 372 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 252 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 372 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::doParse() Line 52 C++
ApplicationMain-debug.exe!swf::exporters::animate::AnimateLibrary_obj::_hx_isInstanceOf(int) C++
ApplicationMain-debug.exe!swf::exporters::animate::AnimateLibrary_obj::__register(void) C++
ApplicationMain-debug.exe!lime::app::Future_obj::onComplete(class Dynamic) C++
ApplicationMain-debug.exe!swf::exporters::animate::AnimateLibrary_obj::load(void) C++
```

The newly allocated string is only 9 chars in length.

I'm not sure what's going on but I only noticed this when trying to load some rtti data attached to a `Class` object and noticed that the XML parser was failing with a different error message each time

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.