OpenXRay / OpenXRay/xray-16

use-after-free in `CPHContactBodyEffector::Apply()`

Open
#1,978 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Code Quality Physics
Dominant language
C++
Stars
3.6k
Forks
536
Avg merge
6d 1h
Merged PRs (30d)
3

Description

ASAN report:

AddressSanitizer: heap-use-after-free on address 0x7d2fcb259148 at pc 0x7fffe0dd86ac bp 0x7ffffffe64e0 sp 0x7ffffffe64d0
READ of size 4 at 0x7d2fcb259148 thread T0
    #0 0x7fffe0dd86ab in dDOT(float const*, float const*) /mnt/data/dev/xray-16/Externals/ode/include/ode/odemath.h:52
    #1 0x7fffcbddbd8f in CPHContactBodyEffector::Apply() /mnt/data/dev/xray-16/src/xrPhysics/PHContactBodyEffector.cpp:26
    #2 0x7fffcbe1f2f1 in CPHElement::PhTune(float) /mnt/data/dev/xray-16/src/xrPhysics/PHElement.cpp:376
    #3 0x7fffcbf35496 in CPHShell::PhTune(float) /mnt/data/dev/xray-16/src/xrPhysics/PHShell.cpp:208
    #4 0x7fffcbf7ddff in CPHWorld::Step() /mnt/data/dev/xray-16/src/xrPhysics/PHWorld.cpp:319
    #5 0x7fffe0c05dab in CCharacterPhysicsSupport::FlyTo(_vector3<float> const&) /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:1314
    #6 0x7fffe0c06a29 in CCharacterPhysicsSupport::EndActivateFreeShell(IGameObject*, _vector3<float> const&, _vector3<float> const&, _vector3<float> const&) /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:1141
    #7 0x7fffe0c1904c in CCharacterPhysicsSupport::KillHit(SHit&) /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:463
    #8 0x7fffe0c1a512 in CCharacterPhysicsSupport::in_Hit(SHit&, bool) /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:492
    #9 0x7fffe0c1aac9 in CCharacterPhysicsSupport::in_Die() /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:1363
    #10 0x7fffe100717f in CEntityAlive::Die(IGameObject*) /mnt/data/dev/xray-16/src/xrGame/entity_alive.cpp:329
    #11 0x7fffe0d5644f in CCustomMonster::Die(IGameObject*) /mnt/data/dev/xray-16/src/xrGame/CustomMonster.cpp:696
    #12 0x7fffe3a071dc in CAI_Stalker::Die(IGameObject*) /mnt/data/dev/xray-16/src/xrGame/ai/stalker/ai_stalker.cpp:472
    #13 0x7fffe102861b in CEntity::OnEvent(NET_Packet&, unsigned short) /mnt/data/dev/xray-16/src/xrGame/Entity.cpp:60
    #14 0x7fffe0d521f8 in CCustomMonster::OnEvent(NET_Packet&, unsigned short) /mnt/data/dev/xray-16/src/xrGame/CustomMonster.cpp:803
    #15 0x7fffe3a5171f in CAI_Stalker::OnEvent(NET_Packet&, unsigned short) /mnt/data/dev/xray-16/src/xrGame/ai/stalker/ai_stalker_events.cpp:26
    #16 0x7fffe1910c41 in CLevel::cl_Process_Event(unsigned short, unsigned short, NET_Packet&) /mnt/data/dev/xray-16/src/xrGame/Level.cpp:276
    #17 0x7fffe19151a5 in CLevel::ProcessGameEvents() /mnt/data/dev/xray-16/src/xrGame/Level.cpp:333
    #18 0x7fffe191adf8 in CLevel::OnFrame() /mnt/data/dev/xray-16/src/xrGame/Level.cpp:447
    #19 0x7fffd16df9ac in pureFrame::OnPure(pureFrame*) /mnt/data/dev/xray-16/src/xrEngine/pure.h:18
    #20 0x7fffd16df9ac in MessageRegistry<pureFrame>::Process() /mnt/data/dev/xray-16/src/xrEngine/pure.h:101
    #21 0x7fffd16cecd7 in CRenderDevice::FrameMove() /mnt/data/dev/xray-16/src/xrEngine/device.cpp:484
    #22 0x7fffd16cf36b in CRenderDevice::ProcessFrame() /mnt/data/dev/xray-16/src/xrEngine/device.cpp:270
    #23 0x7fffd168472e in CApplication::Run() /mnt/data/dev/xray-16/src/xrEngine/x_ray.cpp:433
    #24 0x55555555b4d5 in entry_point(char const*) /mnt/data/dev/xray-16/src/xr_3da/entry_point.cpp:53
    #25 0x55555555b8ed in main /mnt/data/dev/xray-16/src/xr_3da/entry_point.cpp:105
    #26 0x7fffcf027b8a  (/usr/lib/libc.so.6+0x27b8a) (BuildId: 3fb5bf3586fec17ba65a16ec9a3132455897d306)
    #27 0x7fffcf027c4a in __libc_start_main (/usr/lib/libc.so.6+0x27c4a) (BuildId: 3fb5bf3586fec17ba65a16ec9a3132455897d306)
    #28 0x55555555b304 in _start (/mnt/data/dev/xray-16/bin/x86_64/Debug/xr_3da+0x7304) (BuildId: 6816e84c29f929702188eec8451178f5e8e27c05)

0x7d2fcb259148 is located 264 bytes inside of 344-byte region [0x7d2fcb259040,0x7d2fcb259198)
freed by thread T0 here:
    #0 0x7ffff795103d in free /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:51
    #1 0x7fffd048acc3 in xrMemory::mem_free(void*) /mnt/data/dev/xray-16/src/xrCore/xrMemory.cpp:260
    #2 0x7ffff52264f6 in void xr_free<void>(void*&) /mnt/data/dev/xray-16/src/xrCore/xrMemory.h:105
    #3 0x7fffcbd6cf85 in ode_free /mnt/data/dev/xray-16/src/xrPhysics/xrPhysics.cpp:14
    #4 0x7fffcb1acbc7 in dFree /mnt/data/dev/xray-16/Externals/ode/ode/src/memory.cpp:86
    #5 0x7fffcb1afa5a in dBase::operator delete(void*, unsigned long) /mnt/data/dev/xray-16/Externals/ode/ode/src/objects.h:51
    #6 0x7fffcb1afa5a in dBodyDestroy /mnt/data/dev/xray-16/Externals/ode/ode/src/ode.cpp:310
    #7 0x7fffcbd74146 in CPHActivationShape::Destroy() /mnt/data/dev/xray-16/src/xrPhysics/PHActivationShape.cpp:217
    #8 0x7fffcbd6ff5c in ActivateShapeCharacterPhysicsSupport(_vector3<float>&, _vector3<float> const&, _vector3<float> const&, Fmatrix const&, bool, bool, IPhysicsShellHolder*) /mnt/data/dev/xray-16/src/xrPhysics/IActivationShape.cpp:65
    #9 0x7fffe0c03e16 in CCharacterPhysicsSupport::CollisionCorrectObjPos(_vector3<float> const&, bool) /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:706
    #10 0x7fffe0c06627 in CCharacterPhysicsSupport::EndActivateFreeShell(IGameObject*, _vector3<float> const&, _vector3<float> const&, _vector3<float> const&) /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:1129
    #11 0x7fffe0c1904c in CCharacterPhysicsSupport::KillHit(SHit&) /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:463
    #12 0x7fffe0c1a512 in CCharacterPhysicsSupport::in_Hit(SHit&, bool) /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:492
    #13 0x7fffe0c1aac9 in CCharacterPhysicsSupport::in_Die() /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:1363
    #14 0x7fffe100717f in CEntityAlive::Die(IGameObject*) /mnt/data/dev/xray-16/src/xrGame/entity_alive.cpp:329
    #15 0x7fffe0d5644f in CCustomMonster::Die(IGameObject*) /mnt/data/dev/xray-16/src/xrGame/CustomMonster.cpp:696
    #16 0x7fffe3a071dc in CAI_Stalker::Die(IGameObject*) /mnt/data/dev/xray-16/src/xrGame/ai/stalker/ai_stalker.cpp:472
    #17 0x7fffe102861b in CEntity::OnEvent(NET_Packet&, unsigned short) /mnt/data/dev/xray-16/src/xrGame/Entity.cpp:60
    #18 0x7fffe0d521f8 in CCustomMonster::OnEvent(NET_Packet&, unsigned short) /mnt/data/dev/xray-16/src/xrGame/CustomMonster.cpp:803
    #19 0x7fffe3a5171f in CAI_Stalker::OnEvent(NET_Packet&, unsigned short) /mnt/data/dev/xray-16/src/xrGame/ai/stalker/ai_stalker_events.cpp:26
    #20 0x7fffe1910c41 in CLevel::cl_Process_Event(unsigned short, unsigned short, NET_Packet&) /mnt/data/dev/xray-16/src/xrGame/Level.cpp:276
    #21 0x7fffe19151a5 in CLevel::ProcessGameEvents() /mnt/data/dev/xray-16/src/xrGame/Level.cpp:333
    #22 0x7fffe191adf8 in CLevel::OnFrame() /mnt/data/dev/xray-16/src/xrGame/Level.cpp:447
    #23 0x7fffd16df9ac in pureFrame::OnPure(pureFrame*) /mnt/data/dev/xray-16/src/xrEngine/pure.h:18
    #24 0x7fffd16df9ac in MessageRegistry<pureFrame>::Process() /mnt/data/dev/xray-16/src/xrEngine/pure.h:101
    #25 0x7fffd16cecd7 in CRenderDevice::FrameMove() /mnt/data/dev/xray-16/src/xrEngine/device.cpp:484
    #26 0x7fffd16cf36b in CRenderDevice::ProcessFrame() /mnt/data/dev/xray-16/src/xrEngine/device.cpp:270
    #27 0x7fffd168472e in CApplication::Run() /mnt/data/dev/xray-16/src/xrEngine/x_ray.cpp:433
    #28 0x55555555b4d5 in entry_point(char const*) /mnt/data/dev/xray-16/src/xr_3da/entry_point.cpp:53
    #29 0x55555555b8ed in main /mnt/data/dev/xray-16/src/xr_3da/entry_point.cpp:105
    #30 0x7fffcf027b8a  (/usr/lib/libc.so.6+0x27b8a) (BuildId: 3fb5bf3586fec17ba65a16ec9a3132455897d306)
    #31 0x7fffffffd4a3  ([stack]+0x784a3)

previously allocated by thread T0 here:
    #0 0x7ffff7952345 in malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:67
    #1 0x7fffd048ac4b in xrMemory::mem_alloc(unsigned long) /mnt/data/dev/xray-16/src/xrCore/xrMemory.cpp:202
    #2 0x7fffd048ae48 in xr_malloc(unsigned long) /mnt/data/dev/xray-16/src/xrCore/xrMemory.cpp:365
    #3 0x7fffcbd6ce4d in ode_alloc /mnt/data/dev/xray-16/src/xrPhysics/xrPhysics.cpp:12
    #4 0x7fffcb1acb89 in dAlloc /mnt/data/dev/xray-16/Externals/ode/ode/src/memory.cpp:72
    #5 0x7fffcb1b2c2b in dBase::operator new(unsigned long) /mnt/data/dev/xray-16/Externals/ode/ode/src/objects.h:50
    #6 0x7fffcb1b2c2b in dBodyCreate /mnt/data/dev/xray-16/Externals/ode/ode/src/ode.cpp:254
    #7 0x7fffcbd73635 in CPHActivationShape::Create(_vector3<float>, _vector3<float>, IPhysicsShellHolder*, CPHActivationShape::EType, unsigned short) /mnt/data/dev/xray-16/src/xrPhysics/PHActivationShape.cpp:186
    #8 0x7fffcbd6fcd1 in ActivateShapeCharacterPhysicsSupport(_vector3<float>&, _vector3<float> const&, _vector3<float> const&, Fmatrix const&, bool, bool, IPhysicsShellHolder*) /mnt/data/dev/xray-16/src/xrPhysics/IActivationShape.cpp:56
    #9 0x7fffe0c03e16 in CCharacterPhysicsSupport::CollisionCorrectObjPos(_vector3<float> const&, bool) /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:706
    #10 0x7fffe0c06627 in CCharacterPhysicsSupport::EndActivateFreeShell(IGameObject*, _vector3<float> const&, _vector3<float> const&, _vector3<float> const&) /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:1129
    #11 0x7fffe0c1904c in CCharacterPhysicsSupport::KillHit(SHit&) /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:463
    #12 0x7fffe0c1a512 in CCharacterPhysicsSupport::in_Hit(SHit&, bool) /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:492
    #13 0x7fffe0c1aac9 in CCharacterPhysicsSupport::in_Die() /mnt/data/dev/xray-16/src/xrGame/CharacterPhysicsSupport.cpp:1363
    #14 0x7fffe100717f in CEntityAlive::Die(IGameObject*) /mnt/data/dev/xray-16/src/xrGame/entity_alive.cpp:329
    #15 0x7fffe0d5644f in CCustomMonster::Die(IGameObject*) /mnt/data/dev/xray-16/src/xrGame/CustomMonster.cpp:696
    #16 0x7fffe3a071dc in CAI_Stalker::Die(IGameObject*) /mnt/data/dev/xray-16/src/xrGame/ai/stalker/ai_stalker.cpp:472
    #17 0x7fffe102861b in CEntity::OnEvent(NET_Packet&, unsigned short) /mnt/data/dev/xray-16/src/xrGame/Entity.cpp:60
    #18 0x7fffe0d521f8 in CCustomMonster::OnEvent(NET_Packet&, unsigned short) /mnt/data/dev/xray-16/src/xrGame/CustomMonster.cpp:803
    #19 0x7fffe3a5171f in CAI_Stalker::OnEvent(NET_Packet&, unsigned short) /mnt/data/dev/xray-16/src/xrGame/ai/stalker/ai_stalker_events.cpp:26
    #20 0x7fffe1910c41 in CLevel::cl_Process_Event(unsigned short, unsigned short, NET_Packet&) /mnt/data/dev/xray-16/src/xrGame/Level.cpp:276
    #21 0x7fffe19151a5 in CLevel::ProcessGameEvents() /mnt/data/dev/xray-16/src/xrGame/Level.cpp:333
    #22 0x7fffe191adf8 in CLevel::OnFrame() /mnt/data/dev/xray-16/src/xrGame/Level.cpp:447
    #23 0x7fffd16df9ac in pureFrame::OnPure(pureFrame*) /mnt/data/dev/xray-16/src/xrEngine/pure.h:18
    #24 0x7fffd16df9ac in MessageRegistry<pureFrame>::Process() /mnt/data/dev/xray-16/src/xrEngine/pure.h:101
    #25 0x7fffd16cecd7 in CRenderDevice::FrameMove() /mnt/data/dev/xray-16/src/xrEngine/device.cpp:484
    #26 0x7fffd16cf36b in CRenderDevice::ProcessFrame() /mnt/data/dev/xray-16/src/xrEngine/device.cpp:270
    #27 0x7fffd168472e in CApplication::Run() /mnt/data/dev/xray-16/src/xrEngine/x_ray.cpp:433
    #28 0x55555555b4d5 in entry_point(char const*) /mnt/data/dev/xray-16/src/xr_3da/entry_point.cpp:53
    #29 0x55555555b8ed in main /mnt/data/dev/xray-16/src/xr_3da/entry_point.cpp:105
    #30 0x7fffcf027b8a  (/usr/lib/libc.so.6+0x27b8a) (BuildId: 3fb5bf3586fec17ba65a16ec9a3132455897d306)
    #31 0x7fffffffd4a3  ([stack]+0x784a3)

SUMMARY: AddressSanitizer: heap-use-after-free /mnt/data/dev/xray-16/Externals/ode/include/ode/odemath.h:52 in dDOT(float const*, float const*)
Shadow bytes around the buggy address:
  0x7d2fcb258e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d2fcb258f00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x7d2fcb258f80: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa
  0x7d2fcb259000: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x7d2fcb259080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x7d2fcb259100: fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd
  0x7d2fcb259180: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7d2fcb259200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7d2fcb259280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7d2fcb259300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x7d2fcb259380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Happend while playing CS

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at src/xrPhysics/PHContactBodyEffector.cpp:26 and trace the object lifetime through src/xrPhysics/PHActivationShape.cpp:217 and src/xrPhysics/IActivationShape.cpp:65. Reproduce the death path shown by the ASAN stack, beginning with CCharacterPhysicsSupport::EndActivateFreeShell, and verify that the ASAN use-after-free no longer occurs in CPHContactBodyEffector::Apply().

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
game-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.