HaxeFoundation / HaxeFoundation/hxcpp
Allocating a huge string causes heap corruption
- Dominant language
- C++
- Stars
- 330
- Forks
- 227
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 18
Description
I'm trying to compile an openfl application for the Windows target but am encountering heap corruption.
The swf loader tries to parse out a huge json string (4.4 million characters wide) with haxe's `JsonParser` and it eventually corrupts the heap, in `GlobalAllocator::AllocMoreBlocks`. This is the stack at the point the memory I watched was overwritten:
```
ApplicationMain-debug.exe!memset_repmovs() Line 67 Unknown
ApplicationMain-debug.exe!BlockDataInfo::clear() Line 779 C++
ApplicationMain-debug.exe!BlockDataInfo::BlockDataInfo(int inGid, BlockData * inData) Line 770 C++
ApplicationMain-debug.exe!GlobalAllocator::AllocMoreBlocks(bool & outForceCompact, bool inJustBorrowing) Line 3445 C++
ApplicationMain-debug.exe!GlobalAllocator::GetFreeBlock(int inRequiredBytes, hx::ImmixAllocator * inAlloc) Line 3523 C++
ApplicationMain-debug.exe!LocalAllocator::CallAlloc(int inSize, unsigned int inObjectFlags) Line 6156 C++
ApplicationMain-debug.exe!hx::InternalNew(int inSize, bool inIsObject) Line 6487 C++
> ApplicationMain-debug.exe!hx::NewString(int inLen) Line 116 C++
ApplicationMain-debug.exe!GCStringDup(const char * inStr, int inLen, int * outLen) Line 420 C++
ApplicationMain-debug.exe!String::substr(int inFirst, Dynamic inLen) Line 1982 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseString() Line 638 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 356 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 252 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 372 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 252 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 372 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 252 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::parseRec() Line 372 C++
ApplicationMain-debug.exe!haxe::format::JsonParser_obj::doParse() Line 52 C++
ApplicationMain-debug.exe!swf::exporters::animate::AnimateLibrary_obj::_hx_isInstanceOf(int) C++
ApplicationMain-debug.exe!swf::exporters::animate::AnimateLibrary_obj::__register(void) C++
ApplicationMain-debug.exe!lime::app::Future_obj::onComplete(class Dynamic) C++
ApplicationMain-debug.exe!swf::exporters::animate::AnimateLibrary_obj::load(void) C++
```
The newly allocated string is only 9 chars in length.
I'm not sure what's going on but I only noticed this when trying to load some rtti data attached to a `Class` object and noticed that the XML parser was failing with a different error message each time
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.