blf_kerning/blf_unscaled_F26Dot6_to_pixels heap-use-after-free #100242

New Issue

Krzysztof Trzciński · 2022-08-06T13:08:45+02:00

2022-08-06 13:08:45 +02:00

System Information
Operating system: Ubuntu 22.04.1 LTS
Graphics card: GeForce RTX 2070 SUPER

Blender Version
Broken: master branch from github (8f915f0efb)
Worked: N/A

Seems to happen randomly. Sometimes a second after I start Blender jus moving cursor around. Sometimes I get to work for a bit.
Blender gets killed as ASAN aborts when the error happens. Possibly this doesn't get noticed much without ASAN build.

blenderkit updater: Running background check for update
blenderkit addon: Starting background checking thread
blenderkit addon: Checking for update now in background
blenderkit addon: Checking for update function
blenderkit addon: Read in JSON settings from file
blenderkit addon: Determined it's not yet time to check for updates
blenderkit addon: Aborting check for updated, check interval not reached
blenderkit addon: Finished check update, doing callback
blenderkit addon: Running background update callback
blenderkit addon: BG thread: Finished check update, no callback
Read blend: /home/elmo/Documents/blends/furniture.blend
Color management: scene view "Filmic" not found, setting default "Standard".
=================================================================
==68040==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160008f10a0 at pc 0x000008f6faf6 bp 0x7fff39018d80 sp 0x7fff39018d70
READ of size 8 at 0x6160008f10a0 thread T0
    - 0 0x8f6faf5 in blf_unscaled_F26Dot6_to_pixels /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:126
    - 1 0x8f7e2bc in blf_kerning /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:371
    - 2 0x8f7e2bc in blf_font_wrap_apply /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1000
    - 3 0x8f7f0b2 in blf_font_boundbox__wrap /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1099
    - 4 0x8f7af63 in blf_font_width /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:838
    - 5 0x8f6aa71 in BLF_width_ex /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf.c:682
    - 6 0x23d2450 in ui_tooltip_create_with_data /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_region_tooltip.cc:1145
    - 7 0x23d7288 in UI_tooltip_create_from_button_or_extra_icon /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_region_tooltip.cc:1387
    - 8 0x22a4aaf in ui_but_tooltip_init /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_handlers.c:8220
    - 9 0x54c4aa in WM_tooltip_init /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm_tooltip.c:111
    - 10 0x48e17a in wm_event_do_handlers /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm_event_system.cc:3884
    - 11 0x449d17 in WM_main /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm.c:631
    - 12 0x435681 in main /home/elmo/Documents/repos/blender/blender/source/creator/creator.c:546
    - 13 0x7f1d8e498d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    - 14 0x7f1d8e498e3f in __libc_start_main_impl ../csu/libc-start.c:392
    - 15 0x4349e4 in _start (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x4349e4)

0x6160008f10a0 is located 32 bytes inside of 544-byte region [0x6160008f1080,0x6160008f12a0)
freed by thread T0 here:
    - 0 0x7f1d8ea10517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    - 1 0x8f9c2b0 in FT_Done_Size (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8f9c2b0)

previously allocated by thread T0 here:
    - 0 0x7f1d8ea10867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    - 1 0x8f99d14 in ft_mem_alloc (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8f99d14)

SUMMARY: AddressSanitizer: heap-use-after-free /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:126 in blf_unscaled_F26Dot6_to_pixels
Shadow bytes around the buggy address:
  0x0c2c801161c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c801161d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c801161e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c801161f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c80116200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c2c80116210: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80116220: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80116230: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80116240: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80116250: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c80116260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==68040==ABORTING

**System Information** Operating system: Ubuntu 22.04.1 LTS Graphics card: GeForce RTX 2070 SUPER **Blender Version** Broken: master branch from github (8f915f0efba3da652ad06fa9fcfba7d6ca26e719) Worked: N/A Seems to happen randomly. Sometimes a second after I start Blender jus moving cursor around. Sometimes I get to work for a bit. Blender gets killed as ASAN aborts when the error happens. Possibly this doesn't get noticed much without ASAN build. ``` blenderkit updater: Running background check for update blenderkit addon: Starting background checking thread blenderkit addon: Checking for update now in background blenderkit addon: Checking for update function blenderkit addon: Read in JSON settings from file blenderkit addon: Determined it's not yet time to check for updates blenderkit addon: Aborting check for updated, check interval not reached blenderkit addon: Finished check update, doing callback blenderkit addon: Running background update callback blenderkit addon: BG thread: Finished check update, no callback Read blend: /home/elmo/Documents/blends/furniture.blend Color management: scene view "Filmic" not found, setting default "Standard". ================================================================= ==68040==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160008f10a0 at pc 0x000008f6faf6 bp 0x7fff39018d80 sp 0x7fff39018d70 READ of size 8 at 0x6160008f10a0 thread T0 - 0 0x8f6faf5 in blf_unscaled_F26Dot6_to_pixels /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:126 - 1 0x8f7e2bc in blf_kerning /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:371 - 2 0x8f7e2bc in blf_font_wrap_apply /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1000 - 3 0x8f7f0b2 in blf_font_boundbox__wrap /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1099 - 4 0x8f7af63 in blf_font_width /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:838 - 5 0x8f6aa71 in BLF_width_ex /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf.c:682 - 6 0x23d2450 in ui_tooltip_create_with_data /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_region_tooltip.cc:1145 - 7 0x23d7288 in UI_tooltip_create_from_button_or_extra_icon /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_region_tooltip.cc:1387 - 8 0x22a4aaf in ui_but_tooltip_init /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_handlers.c:8220 - 9 0x54c4aa in WM_tooltip_init /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm_tooltip.c:111 - 10 0x48e17a in wm_event_do_handlers /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm_event_system.cc:3884 - 11 0x449d17 in WM_main /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm.c:631 - 12 0x435681 in main /home/elmo/Documents/repos/blender/blender/source/creator/creator.c:546 - 13 0x7f1d8e498d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 - 14 0x7f1d8e498e3f in __libc_start_main_impl ../csu/libc-start.c:392 - 15 0x4349e4 in _start (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x4349e4) 0x6160008f10a0 is located 32 bytes inside of 544-byte region [0x6160008f1080,0x6160008f12a0) freed by thread T0 here: - 0 0x7f1d8ea10517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127 - 1 0x8f9c2b0 in FT_Done_Size (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8f9c2b0) previously allocated by thread T0 here: - 0 0x7f1d8ea10867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 - 1 0x8f99d14 in ft_mem_alloc (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8f99d14) SUMMARY: AddressSanitizer: heap-use-after-free /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:126 in blf_unscaled_F26Dot6_to_pixels Shadow bytes around the buggy address: 0x0c2c801161c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c801161d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c801161e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c801161f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c80116200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c2c80116210: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd 0x0c2c80116220: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c80116230: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c80116240: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c80116250: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c80116260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==68040==ABORTING ```

Krzysztof Trzciński commented

2022-08-06 13:08:45 +02:00

Added subscriber: @elmo

Robert Guetzkow commented

2022-08-06 16:25:22 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'

Robert Guetzkow commented

2022-08-06 16:33:33 +02:00

Added subscriber: @Harley

Krzysztof Trzciński commented

2022-08-06 17:28:53 +02:00

I managed to get a crash with fast unwind disabled:

==74451==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160008673a0 at pc 0x000008f6faf6 bp 0x7ffcd029ac10 sp 0x7ffcd029ac00
READ of size 8 at 0x6160008673a0 thread T0
    - 0 0x8f6faf5 in blf_unscaled_F26Dot6_to_pixels /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:126
    - 1 0x8f7e2bc in blf_kerning /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:371
    - 2 0x8f7e2bc in blf_font_wrap_apply /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1000
    - 3 0x8f7f0b2 in blf_font_boundbox__wrap /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1099
    - 4 0x8f7af63 in blf_font_width /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:838
    - 5 0x8f6aa71 in BLF_width_ex /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf.c:682
    - 6 0x23d2450 in ui_tooltip_create_with_data /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_region_tooltip.cc:1145
    - 7 0x23d7288 in UI_tooltip_create_from_button_or_extra_icon /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_region_tooltip.cc:1387
    - 8 0x22a4aaf in ui_but_tooltip_init /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_handlers.c:8220
    - 9 0x54c4aa in WM_tooltip_init /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm_tooltip.c:111
    - 10 0x48e17a in wm_event_do_handlers /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm_event_system.cc:3884
    - 11 0x449d17 in WM_main /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm.c:631
    - 12 0x435681 in main /home/elmo/Documents/repos/blender/blender/source/creator/creator.c:546
    - 13 0x7fd9b798fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    - 14 0x7fd9b798fe3f in __libc_start_main_impl ../csu/libc-start.c:392
    - 15 0x4349e4 in _start (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x4349e4)

0x6160008673a0 is located 32 bytes inside of 544-byte region [0x616000867380,0x6160008675a0)
freed by thread T0 here:
    - 0 0x7fd9b7f07517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    - 1 0x8f9c2b0 in FT_Done_Size (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8f9c2b0)
    - 2 0x8fa47fe in FTC_MruList_Remove (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa47fe)
    - 3 0x8fa4867 in FTC_MruList_RemoveSelection (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa4867)
    - 4 0x8fa531a in ftc_face_node_done (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa531a)
    - 5 0x8fa5212 in FTC_MruList_New (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa5212)
    - 6 0x8fa6a98 in FTC_Manager_LookupFace (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa6a98)
    - 7 0x8fa6c87 in FTC_CMapCache_Lookup (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa6c87)
    - 8 0x8f6fa0c in blf_get_char_index /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:115
    - 9 0x8f89f4f in blf_glyph_index_from_charcode /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_glyph.c:587
    - 10 0x8f8df44 in blf_glyph_ensure /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_glyph.c:984
    - 11 0x8f7d5ea in blf_glyph_from_utf8_and_step /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:340
    - 12 0x8f7d5ea in blf_font_wrap_apply /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:995
    - 13 0x8f7f0b2 in blf_font_boundbox__wrap /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1099
    - 14 0x8f7af63 in blf_font_width /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:838
    - 15 0x8f6aa71 in BLF_width_ex /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf.c:682
    - 16 0x23d2450 in ui_tooltip_create_with_data /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_region_tooltip.cc:1145
    - 17 0x23d7288 in UI_tooltip_create_from_button_or_extra_icon /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_region_tooltip.cc:1387
    - 18 0x22a4aaf in ui_but_tooltip_init /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_handlers.c:8220
    - 19 0x54c4aa in WM_tooltip_init /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm_tooltip.c:111
    - 20 0x48e17a in wm_event_do_handlers /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm_event_system.cc:3884
    - 21 0x449d17 in WM_main /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm.c:631
    - 22 0x435681 in main /home/elmo/Documents/repos/blender/blender/source/creator/creator.c:546
    - 23 0x7fd9b798fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    - 24 0x7fd9b798fe3f in __libc_start_main_impl ../csu/libc-start.c:392
    - 25 0x4349e4 in _start (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x4349e4)

previously allocated by thread T0 here:
    - 0 0x7fd9b7f07867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    - 1 0x8f99d14 in ft_mem_alloc (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8f99d14)
    - 2 0x8f9c08b in FT_New_Size (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8f9c08b)
    - 3 0x8fa6dfd in ftc_scaler_lookup_size (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa6dfd)
    - 4 0x8fa5248 in FTC_MruList_New (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa5248)
    - 5 0x8fa68bb in FTC_Manager_LookupSize (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa68bb)
    - 6 0x8f83f09 in blf_font_size /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1541
    - 7 0x8f67e50 in BLF_size /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf.c:368
    - 8 0x23e071e in UI_fontstyle_set /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_style.cc:499
    - 9 0x23dea0b in UI_fontstyle_string_width /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_style.cc:342
    - 10 0x23ded41 in UI_fontstyle_string_width_with_block_aspect /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_style.cc:357
    - 11 0x22f8556 in ui_text_icon_width_ex /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_layout.c:349
    - 12 0x2311414 in ui_item_menu /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_layout.c:2944
    - 13 0x2311f44 in uiItemM_ptr /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_layout.c:2998
    - 14 0x2311fc6 in uiItemM /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_layout.c:3015
    - 15 0x459c2ed in rna_uiItemM /home/elmo/Documents/repos/blender/blender/source/blender/makesrna/intern/rna_ui_api.c:431
    - 16 0x45ae5a7 in UILayout_menu_call /home/elmo/Documents/repos/blender/build_linux_debug_lite/source/blender/makesrna/intern/rna_ui_gen.c:2371
    - 17 0x3c3f1d1 in RNA_function_call /home/elmo/Documents/repos/blender/blender/source/blender/makesrna/intern/rna_access.c:6133
    - 18 0x4822981 in pyrna_func_call /home/elmo/Documents/repos/blender/blender/source/blender/python/intern/bpy_rna.c:6320
    - 19 0x9441987 in _PyObject_MakeTpCall Objects/call.c:215
    - 20 0x4326ce in _PyObject_VectorcallTstate Include/cpython/abstract.h:112
    - 21 0x4326ce in _PyObject_VectorcallTstate Include/cpython/abstract.h:99
    - 22 0x4326ce in PyObject_Vectorcall Include/cpython/abstract.h:123
    - 23 0x4326ce in call_function Python/ceval.c:5867
    - 24 0x4326ce in _PyEval_EvalFrameDefault Python/ceval.c:4181
    - 25 0x9500013 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:46
    - 26 0x9500013 in _PyEval_Vector Python/ceval.c:5065
    - 27 0x944160e in PyVectorcall_Call Objects/call.c:255
    - 28 0x482c963 in bpy_class_call /home/elmo/Documents/repos/blender/blender/source/blender/python/intern/bpy_rna.c:8606
    - 29 0x4597b16 in menu_draw /home/elmo/Documents/repos/blender/blender/source/blender/makesrna/intern/rna_ui.c:900
    - 30 0x234070e in UI_menutype_draw /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_layout.c:5812
    - 31 0x231219e in uiItemMContents /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_layout.c:3031
    - 32 0x459c317 in rna_uiItemM_contents /home/elmo/Documents/repos/blender/blender/source/blender/makesrna/intern/rna_ui_api.c:436
    - 33 0x45ae709 in UILayout_menu_contents_call /home/elmo/Documents/repos/blender/build_linux_debug_lite/source/blender/makesrna/intern/rna_ui_gen.c:2389

SUMMARY: AddressSanitizer: heap-use-after-free /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:126 in blf_unscaled_F26Dot6_to_pixels
Shadow bytes around the buggy address:
  0x0c2c80104e20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80104e30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80104e40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80104e50: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c80104e60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c2c80104e70: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80104e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80104e90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80104ea0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c80104eb0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c80104ec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==74451==ABORTING

I managed to get a crash with fast unwind disabled: ``` ==74451==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160008673a0 at pc 0x000008f6faf6 bp 0x7ffcd029ac10 sp 0x7ffcd029ac00 READ of size 8 at 0x6160008673a0 thread T0 - 0 0x8f6faf5 in blf_unscaled_F26Dot6_to_pixels /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:126 - 1 0x8f7e2bc in blf_kerning /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:371 - 2 0x8f7e2bc in blf_font_wrap_apply /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1000 - 3 0x8f7f0b2 in blf_font_boundbox__wrap /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1099 - 4 0x8f7af63 in blf_font_width /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:838 - 5 0x8f6aa71 in BLF_width_ex /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf.c:682 - 6 0x23d2450 in ui_tooltip_create_with_data /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_region_tooltip.cc:1145 - 7 0x23d7288 in UI_tooltip_create_from_button_or_extra_icon /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_region_tooltip.cc:1387 - 8 0x22a4aaf in ui_but_tooltip_init /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_handlers.c:8220 - 9 0x54c4aa in WM_tooltip_init /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm_tooltip.c:111 - 10 0x48e17a in wm_event_do_handlers /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm_event_system.cc:3884 - 11 0x449d17 in WM_main /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm.c:631 - 12 0x435681 in main /home/elmo/Documents/repos/blender/blender/source/creator/creator.c:546 - 13 0x7fd9b798fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 - 14 0x7fd9b798fe3f in __libc_start_main_impl ../csu/libc-start.c:392 - 15 0x4349e4 in _start (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x4349e4) 0x6160008673a0 is located 32 bytes inside of 544-byte region [0x616000867380,0x6160008675a0) freed by thread T0 here: - 0 0x7fd9b7f07517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127 - 1 0x8f9c2b0 in FT_Done_Size (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8f9c2b0) - 2 0x8fa47fe in FTC_MruList_Remove (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa47fe) - 3 0x8fa4867 in FTC_MruList_RemoveSelection (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa4867) - 4 0x8fa531a in ftc_face_node_done (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa531a) - 5 0x8fa5212 in FTC_MruList_New (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa5212) - 6 0x8fa6a98 in FTC_Manager_LookupFace (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa6a98) - 7 0x8fa6c87 in FTC_CMapCache_Lookup (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa6c87) - 8 0x8f6fa0c in blf_get_char_index /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:115 - 9 0x8f89f4f in blf_glyph_index_from_charcode /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_glyph.c:587 - 10 0x8f8df44 in blf_glyph_ensure /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_glyph.c:984 - 11 0x8f7d5ea in blf_glyph_from_utf8_and_step /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:340 - 12 0x8f7d5ea in blf_font_wrap_apply /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:995 - 13 0x8f7f0b2 in blf_font_boundbox__wrap /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1099 - 14 0x8f7af63 in blf_font_width /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:838 - 15 0x8f6aa71 in BLF_width_ex /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf.c:682 - 16 0x23d2450 in ui_tooltip_create_with_data /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_region_tooltip.cc:1145 - 17 0x23d7288 in UI_tooltip_create_from_button_or_extra_icon /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_region_tooltip.cc:1387 - 18 0x22a4aaf in ui_but_tooltip_init /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_handlers.c:8220 - 19 0x54c4aa in WM_tooltip_init /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm_tooltip.c:111 - 20 0x48e17a in wm_event_do_handlers /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm_event_system.cc:3884 - 21 0x449d17 in WM_main /home/elmo/Documents/repos/blender/blender/source/blender/windowmanager/intern/wm.c:631 - 22 0x435681 in main /home/elmo/Documents/repos/blender/blender/source/creator/creator.c:546 - 23 0x7fd9b798fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 - 24 0x7fd9b798fe3f in __libc_start_main_impl ../csu/libc-start.c:392 - 25 0x4349e4 in _start (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x4349e4) previously allocated by thread T0 here: - 0 0x7fd9b7f07867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 - 1 0x8f99d14 in ft_mem_alloc (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8f99d14) - 2 0x8f9c08b in FT_New_Size (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8f9c08b) - 3 0x8fa6dfd in ftc_scaler_lookup_size (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa6dfd) - 4 0x8fa5248 in FTC_MruList_New (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa5248) - 5 0x8fa68bb in FTC_Manager_LookupSize (/home/elmo/Documents/repos/blender/build_linux_debug_lite/bin/blender+0x8fa68bb) - 6 0x8f83f09 in blf_font_size /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1541 - 7 0x8f67e50 in BLF_size /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf.c:368 - 8 0x23e071e in UI_fontstyle_set /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_style.cc:499 - 9 0x23dea0b in UI_fontstyle_string_width /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_style.cc:342 - 10 0x23ded41 in UI_fontstyle_string_width_with_block_aspect /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_style.cc:357 - 11 0x22f8556 in ui_text_icon_width_ex /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_layout.c:349 - 12 0x2311414 in ui_item_menu /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_layout.c:2944 - 13 0x2311f44 in uiItemM_ptr /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_layout.c:2998 - 14 0x2311fc6 in uiItemM /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_layout.c:3015 - 15 0x459c2ed in rna_uiItemM /home/elmo/Documents/repos/blender/blender/source/blender/makesrna/intern/rna_ui_api.c:431 - 16 0x45ae5a7 in UILayout_menu_call /home/elmo/Documents/repos/blender/build_linux_debug_lite/source/blender/makesrna/intern/rna_ui_gen.c:2371 - 17 0x3c3f1d1 in RNA_function_call /home/elmo/Documents/repos/blender/blender/source/blender/makesrna/intern/rna_access.c:6133 - 18 0x4822981 in pyrna_func_call /home/elmo/Documents/repos/blender/blender/source/blender/python/intern/bpy_rna.c:6320 - 19 0x9441987 in _PyObject_MakeTpCall Objects/call.c:215 - 20 0x4326ce in _PyObject_VectorcallTstate Include/cpython/abstract.h:112 - 21 0x4326ce in _PyObject_VectorcallTstate Include/cpython/abstract.h:99 - 22 0x4326ce in PyObject_Vectorcall Include/cpython/abstract.h:123 - 23 0x4326ce in call_function Python/ceval.c:5867 - 24 0x4326ce in _PyEval_EvalFrameDefault Python/ceval.c:4181 - 25 0x9500013 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:46 - 26 0x9500013 in _PyEval_Vector Python/ceval.c:5065 - 27 0x944160e in PyVectorcall_Call Objects/call.c:255 - 28 0x482c963 in bpy_class_call /home/elmo/Documents/repos/blender/blender/source/blender/python/intern/bpy_rna.c:8606 - 29 0x4597b16 in menu_draw /home/elmo/Documents/repos/blender/blender/source/blender/makesrna/intern/rna_ui.c:900 - 30 0x234070e in UI_menutype_draw /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_layout.c:5812 - 31 0x231219e in uiItemMContents /home/elmo/Documents/repos/blender/blender/source/blender/editors/interface/interface_layout.c:3031 - 32 0x459c317 in rna_uiItemM_contents /home/elmo/Documents/repos/blender/blender/source/blender/makesrna/intern/rna_ui_api.c:436 - 33 0x45ae709 in UILayout_menu_contents_call /home/elmo/Documents/repos/blender/build_linux_debug_lite/source/blender/makesrna/intern/rna_ui_gen.c:2389 SUMMARY: AddressSanitizer: heap-use-after-free /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:126 in blf_unscaled_F26Dot6_to_pixels Shadow bytes around the buggy address: 0x0c2c80104e20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c80104e30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c80104e40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c80104e50: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c80104e60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c2c80104e70: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd 0x0c2c80104e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c80104e90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c80104ea0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c80104eb0: fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c80104ec0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==74451==ABORTING ```

Krzysztof Trzciński commented

2022-08-06 17:32:48 +02:00

Looking at stacktrace I can see ui_but_tooltip_init and that hinted me on how to reliably reproduce issue. On splash screen I just move cursor over one of last open file names and wait. It seems that it crashes when it tries to show tooltip.
I have tried some other tooltip areas and oddly some work. I.e. thing in the properties panel seem to work. But hovering over "eye" icon or "camera" icon causes an ASAN crash.

Looking at stacktrace I can see `ui_but_tooltip_init` and that hinted me on how to reliably reproduce issue. On splash screen I just move cursor over one of last open file names and wait. It seems that it crashes when it tries to show tooltip. I have tried some other tooltip areas and oddly some work. I.e. thing in the properties panel seem to work. But hovering over "eye" icon or "camera" icon causes an ASAN crash.

Harley Acheson self-assigned this 2022-08-06 18:11:59 +02:00

Harley Acheson commented

2022-08-06 18:11:59 +02:00

The following might have wrong assumptions, so feel free to chine in, help out, and correct.

Fairly certain that In blf_unscaled_F26Dot6_to_pixels the only thing that could be used after feeing is the "ft_size" member of the font. I'm guessing that this is just a normal result of the newly-added FreeType caching system that I am not dealing with correctly. I am adding an ft_size to the font when we size it, but the cache is removing sizes whenever it wants or needs to.

First, I really need to set that ft_size member of the font to NULL when the cache removes it. Then I think I need to add an "ensure_size" that can be called only when I need to get at that thing. That way the font can continue to work without face and without size unless absolutely needed.

Timing of a fix might be problematic. I think anyone that could/should review would be in Vancouver now for Siggraph. Will see what I can do.

The following might have wrong assumptions, so feel free to chine in, help out, and correct. Fairly certain that In `blf_unscaled_F26Dot6_to_pixels` the only thing that *could* be used after feeing is the "ft_size" member of the font. I'm guessing that this is just a normal result of the newly-added FreeType caching system that I am not dealing with correctly. I am adding an ft_size to the font when we size it, but the cache is removing sizes whenever it wants or needs to. First, I really need to set that ft_size member of the font to NULL when the cache removes it. Then I think I need to add an "ensure_size" that can be called only when I need to get at that thing. That way the font can continue to work without face and without size unless absolutely needed. Timing of a fix might be problematic. I *think* anyone that could/should review would be in Vancouver now for Siggraph. Will see what I can do.

Ray molenkamp commented

2022-08-06 18:15:27 +02:00

Added subscriber: @LazyDodo

Ray molenkamp commented

2022-08-06 18:15:27 +02:00

If landing a fix is problematic, reverting the caching commit that caused the issue should require much less approval?

Harley Acheson commented

2022-08-06 18:19:41 +02:00

@elmo - It would be great if I could get your assistance with this. I might submit a patch and initially add just you as reviewer so that you can compile and confirm that it fixes this issue. Then I'd remove you and add a technical code reviewer. Does that sound like something you could do?

Krzysztof Trzciński commented

2022-08-06 19:27:19 +02:00

I can definitely try to compile with patch and see if it helps.
As for helping with understanding an issue and/or reviewing I am not sure how much I can help as I have very little familiarity with Blender source code and I have never before today looked at FreeType library.

Your explanation as to what is going wrong is what I was guessing from what I could see in code. I am not sure how you'd discover that FT decided to free something from cache (again, I'm not familiar with that at all).

I can definitely try to compile with patch and see if it helps. As for helping with understanding an issue and/or reviewing I am not sure how much I can help as I have very little familiarity with Blender source code and I have never before today looked at FreeType library. Your explanation as to what is going wrong is what I was guessing from what I could see in code. I am not sure how you'd discover that FT decided to free something from cache (again, I'm not familiar with that at all).

Harley Acheson commented

2022-08-06 19:40:12 +02:00

@elmo - I can definitely try to compile with patch and see if it helps...

Actually that is all I'd need since you have been able to see/recreate this error it would be wonderful for you to confirm it fixes it (or does not).

am not sure how you'd discover that FT decided to free something from cache

FreeType has a callback for this. You'll see that in the patch when I submit it. But again, just compiling and seeing that it does not cause the error is a big help.

> @elmo - I can definitely try to compile with patch and see if it helps... Actually that is all I'd need since you have been able to see/recreate this error it would be wonderful for you to confirm it fixes it (or does not). > am not sure how you'd discover that FT decided to free something from cache FreeType has a callback for this. You'll see that in the patch when I submit it. But again, just compiling and seeing that it does not cause the error is a big help.

Harley Acheson commented

2022-08-06 20:19:53 +02:00

@elmo - I wasn't able to add your name as reviewer to my diff (this interface doesn't seem to like your nick or name).

So can you apply, compile and test the following?

https://developer.blender.org/D15639

@elmo - I wasn't able to add your name as reviewer to my diff (this interface doesn't seem to like your nick or name). So can you apply, compile and test the following? https://developer.blender.org/D15639

Krzysztof Trzciński commented

2022-08-06 20:29:28 +02:00

/home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c: In function ‘blf_ensure_size’:
/home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1558:1: error: control reaches end of non-void function [-Werror=return-type]
 1558 | }

There is BLI_assert_unreachable(); at the end of that function. Not sure how other places do not fail/warn on this.

``` /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c: In function ‘blf_ensure_size’: /home/elmo/Documents/repos/blender/blender/source/blender/blenfont/intern/blf_font.c:1558:1: error: control reaches end of non-void function [-Werror=return-type] 1558 | } ``` There is ` BLI_assert_unreachable();` at the end of that function. Not sure how other places do not fail/warn on this.

Krzysztof Trzciński commented

2022-08-06 20:30:51 +02:00

All other places are followed by some kind of return, so I guess that answer that question. I think we want return false after the assert.

All other places are followed by some kind of return, so I guess that answer that question. I think we want `return false` after the assert.

Krzysztof Trzciński commented

2022-08-06 20:32:43 +02:00

With your patch and the extra return false it no longer crashes and I get a tooltip to appear both on the splash/greeting window and when hovering over icons in outliner.

With your patch and the extra `return false` it no longer crashes and I get a tooltip to appear both on the splash/greeting window and when hovering over icons in outliner.

Harley Acheson commented

2022-08-06 20:46:06 +02:00

@elmo - Yes, added a return false after that BLI_assert_unreachable; I forgot that compilers might complain about that. LOL

Thanks for testing!

I'll see what I can do with this weird timing. We might just revert the caching commit until Brecht is back, or wait for review of this fix, or (possibly) commit fix early and review again later.

@elmo - Yes, added a `return false` after that `BLI_assert_unreachable`; I forgot that compilers might complain about that. LOL Thanks for testing! I'll see what I can do with this weird timing. We might just revert the caching commit until Brecht is back, or wait for review of this fix, or (possibly) commit fix early and review again later.

blender-admin commented

2022-08-09 02:23:25 +02:00

This issue was referenced by 8b3e3c1810

This issue was referenced by 8b3e3c18100aac6ac956e782dc108aae500eac93

Harley Acheson commented

2022-08-09 02:24:29 +02:00

Changed status from 'Confirmed' to: 'Resolved'

Harley Acheson closed this issue

2022-08-09 02:24:29 +02:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

blf_kerning/blf_unscaled_F26Dot6_to_pixels heap-use-after-free #100242