Address Sanitizer reports read overrun in blender/windowmanager/intern/wm_operator_props.c #69469

New Issue

Garry R. Osgood · 2019-09-04T02:59:56+02:00

Garry R. Osgood commented

2019-09-04 02:59:56 +02:00

System Information
Operating system: Linux bertha 5.2.0-gentoo-bertha #1 SMP Sat Jul 13 21:34:03 EDT 2019 x86_64 Intel(R) Xeon(R) CPU E5-2630 v4 @ 2.20GHz GenuineIntel GNU/Linux
Graphics card: Radeon Pro WX 9100 (VEGA10, DRM 3.32.0, 5.2.0-gentoo-bertha, LLVM 7.1.0)

Blender Version
Broken: 2.81 (sub 5), Tue Sep 3 21:45:39 2019 +0200 commit 1af0f1fed9 HEAD -> master

Short description of error
Address Sanitizer reporting a read overrun of eight bytes of a buffer; aborts blender.
Exact steps for others to reproduce the error

Build a debug blender with Address Sanitizer enabled. i.e. 'make developer debug', specifically with cmake flag WITH_COMPILER_ASAN=ON
Run blender. Address Sanitizer aborts on startup

Run blender again. Now, preferably, in a debugger. See what's up (my notes on seeing what's up is below)

Blend file
Not triggered by a blend file - Can't get that far.
Address Sanitizer dump
adrsan.txt
Where the Plot Sickens
Stems from commit ee8f69c96c
Author: Julian Eisel eiseljulian@gmail.com
Date: Tue Sep 3 15:43:38 2019 +0200

With that commit, a static const EnumPropertyItem file_action_types- [ ] wm_operatorprops.c, line 81
lacking a terminating sentry record is defined and passed to RNA_def_enum(...) as an items buffer. See line 207, same file.
RNA_def_enum, failing to find the sentry record, reads past the buffer and Thus Offends The Address Sanitizer Gods.
To be picky, the overflow specifically takes place in rna_define.c:RNA_def_property_enum_items(...), called by RNA_def_enum(...)
See rna_define.c, line 1776

To keep RNA_def_property_enum_items(...) happy, methinks the enum file_action_type needs to be given a final sentry item filled with zero bytes. Template here:
rna_space.c line 419

@JulianEisel, could you take a look, please. Take care!

**System Information** Operating system: Linux bertha 5.2.0-gentoo-bertha #1 SMP Sat Jul 13 21:34:03 EDT 2019 x86_64 Intel(R) Xeon(R) CPU E5-2630 v4 @ 2.20GHz GenuineIntel GNU/Linux Graphics card: Radeon Pro WX 9100 (VEGA10, DRM 3.32.0, 5.2.0-gentoo-bertha, LLVM 7.1.0) **Blender Version** Broken: 2.81 (sub 5), Tue Sep 3 21:45:39 2019 +0200 commit 1af0f1fed9a680df6cdde9c2b220b5ddc9bf03e0 HEAD -> master **Short description of error** Address Sanitizer reporting a read overrun of eight bytes of a buffer; aborts blender. **Exact steps for others to reproduce the error** - Build a debug blender with Address Sanitizer enabled. i.e. 'make developer debug', specifically with cmake flag WITH_COMPILER_ASAN=ON - Run blender. Address Sanitizer aborts on startup ## Run blender again. Now, preferably, in a debugger. See what's up (my notes on seeing what's up is below) **Blend file** Not triggered by a blend file - Can't get that far. **Address Sanitizer dump** [adrsan.txt](https://archive.blender.org/developer/F7715831/adrsan.txt) **Where the Plot Sickens** Stems from commit ee8f69c96cba62b083fb089432cddd0bce5d08e1 Author: Julian Eisel <eiseljulian@gmail.com> Date: Tue Sep 3 15:43:38 2019 +0200 With that commit, a static const EnumPropertyItem file_action_types- [ ] [wm_operatorprops.c, line 81](https://developer.blender.org/diffusion/B/browse/master/source/blender/windowmanager/intern/wm_operator_props.c) lacking a terminating sentry record is defined and passed to RNA_def_enum(...) as an items buffer. See line 207, same file. RNA_def_enum, failing to find the sentry record, reads past the buffer and Thus Offends The Address Sanitizer Gods. To be picky, the overflow specifically takes place in rna_define.c:RNA_def_property_enum_items(...), called by RNA_def_enum(...) See [rna_define.c, line 1776](https://developer.blender.org/diffusion/B/browse/master/source/blender/makesrna/intern/rna_define.c) To keep RNA_def_property_enum_items(...) happy, methinks the enum file_action_type needs to be given a final sentry item filled with zero bytes. Template here: [rna_space.c line 419](https://developer.blender.org/diffusion/B/browse/master/source/blender/makesrna/intern/rna_space.c) @JulianEisel, could you take a look, please. Take care!

Garry R. Osgood commented

2019-09-04 02:59:56 +02:00

Added subscribers: @JulianEisel, @grosgood