Crash in BKE_ptcache_make_particle_key #49283

New Issue

Alexander Romanov · 2016-09-07T16:33:17+02:00

Alexander Romanov commented

2016-09-07 16:33:17 +02:00

Exact steps for others to reproduce the error

Compile Blender with -fsanitize=address flag
Run blender and open main.blend
Crash

For me under debugger it is not crashing. The cause is index = -1

==12713==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d00079fe7c at pc 0x7f7daa418565 bp 0x7ffd2459fb60 sp 0x7ffd2459f310
READ of size 12 at 0x61d00079fe7c thread T0
    - 0 0x7f7daa418564 in __asan_memcpy ../../.././libsanitizer/asan/asan_interceptors.cc:367
    - 1 0x4017a4d in BKE_ptcache_make_particle_key /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/pointcache.c:242
    - 2 0x3f8e6a2 in get_pointcache_keys_for_time /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/particle.c:889
    - 3 0x3f914ad in do_particle_interpolation /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/particle.c:1099
    - 4 0x3fb039c in psys_get_particle_on_path /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/particle.c:3722
    - 5 0x207e6f5 in draw_new_particle_system /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/drawobject.c:5331
    - 6 0x2093a2b in draw_object /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/drawobject.c:7823
    - 7 0x1fd4768 in draw_dupli_objects_color /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:2193
    - 8 0x1fd4b8b in draw_dupli_objects /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:2225
    - 9 0x1fda296 in view3d_draw_objects /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:2840
    - 10 0x1fe1e03 in view3d_main_region_draw_objects /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:3901
    - 11 0x1fe30cc in view3d_main_region_draw /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:4052
    - 12 0x2abcd6b in ED_region_do_draw /home/dal/workspace/blender-git/blender/source/blender/editors/screen/area.c:518
    - 13 0x1d1bf47 in wm_method_draw_triple /home/dal/workspace/blender-git/blender/source/blender/windowmanager/intern/wm_draw.c:557
    - 14 0x1d1e597 in wm_draw_update /home/dal/workspace/blender-git/blender/source/blender/windowmanager/intern/wm_draw.c:956
    - 15 0x1d0f882 in WM_main /home/dal/workspace/blender-git/blender/source/blender/windowmanager/intern/wm.c:495
    - 16 0x1d05a07 in main /home/dal/workspace/blender-git/blender/source/creator/creator.c:527
    - 17 0x7f7da39cf82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #18 0x1d04d98 in _start (/home/dal/workspace/blender-git/build_1/bin/blender+0x1d04d98)

0x61d00079fe7c is located 4 bytes to the left of 2360-byte region [0x61d00079fe80,0x61d0007a07b8)
allocated by thread T15 here:
    - 0 0x7f7daa424121 in __interceptor_calloc ../../.././libsanitizer/asan/asan_malloc_linux.cc:54
    - 1 0x4cbf775 in MEM_lockfree_callocN /home/dal/workspace/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:286
    - 2 0x40280ee in ptcache_data_alloc /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/pointcache.c:2186
    - 3 0x402d3e4 in ptcache_write /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/pointcache.c:2796
    - 4 0x402e153 in BKE_ptcache_write /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/pointcache.c:2922
    - 5 0x3fe7775 in system_step /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/particle_system.c:4014
    - 6 0x3feaeb1 in particle_system_update /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/particle_system.c:4303
    - 7 0x331980b in deformVerts /home/dal/workspace/blender-git/blender/source/blender/modifiers/intern/MOD_particlesystem.c:189
    - 8 0x3ef2408 in modwrap_deformVerts /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/modifier.c:774
    - 9 0x3b7e057 in mesh_calc_modifiers /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.c:1842
    - 10 0x3b837d8 in mesh_build_data /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.c:2611
    - 11 0x3b8426f in makeDerivedMesh /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.c:2708
    - 12 0x3f785e1 in BKE_object_handle_data_update /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/object_update.c:201
    - 13 0x3f5dc1c in BKE_object_handle_update_ex /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/object.c:2692
    - 14 0x4056673 in scene_update_object_func /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/scene.c:1497
    - 15 0x48d3259 in task_scheduler_thread_run /home/dal/workspace/blender-git/blender/source/blender/blenlib/intern/task.c:326
    #16 0x7f7da3f836f9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76f9)

Thread T15 created by T0 here:
    - 0 0x7f7daa3c6014 in __interceptor_pthread_create ../../.././libsanitizer/asan/asan_interceptors.cc:179
    - 1 0x48d36ba in BLI_task_scheduler_create /home/dal/workspace/blender-git/blender/source/blender/blenlib/intern/task.c:377
    - 2 0x48d68c1 in BLI_task_scheduler_get /home/dal/workspace/blender-git/blender/source/blender/blenlib/intern/threads.c:174
    - 3 0x4056e3c in scene_update_objects /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/scene.c:1624
    - 4 0x4057253 in scene_update_tagged_recursive /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/scene.c:1705
    - 5 0x40579fc in BKE_scene_update_tagged /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/scene.c:1808
    - 6 0x1d214dc in wm_event_do_notifiers /home/dal/workspace/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:404
    - 7 0x1d0f876 in WM_main /home/dal/workspace/blender-git/blender/source/blender/windowmanager/intern/wm.c:492
    - 8 0x1d05a07 in main /home/dal/workspace/blender-git/blender/source/creator/creator.c:527
    - 9 0x7f7da39cf82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../.././libsanitizer/asan/asan_interceptors.cc:367 __asan_memcpy
Shadow bytes around the buggy address:
  0x0c3a800ebf70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800ebf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800ebf90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800ebfa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800ebfb0: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
=>0x0c3a800ebfc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
  0x0c3a800ebfd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800ebfe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800ebff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800ec000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c3a800ec010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==12713==ABORTING

crash.zip

**Exact steps for others to reproduce the error** - Compile Blender with -fsanitize=address flag - Run blender and open main.blend - > Crash For me under debugger it is not crashing. The cause is index = -1 ``` ==12713==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d00079fe7c at pc 0x7f7daa418565 bp 0x7ffd2459fb60 sp 0x7ffd2459f310 READ of size 12 at 0x61d00079fe7c thread T0 - 0 0x7f7daa418564 in __asan_memcpy ../../.././libsanitizer/asan/asan_interceptors.cc:367 - 1 0x4017a4d in BKE_ptcache_make_particle_key /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/pointcache.c:242 - 2 0x3f8e6a2 in get_pointcache_keys_for_time /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/particle.c:889 - 3 0x3f914ad in do_particle_interpolation /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/particle.c:1099 - 4 0x3fb039c in psys_get_particle_on_path /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/particle.c:3722 - 5 0x207e6f5 in draw_new_particle_system /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/drawobject.c:5331 - 6 0x2093a2b in draw_object /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/drawobject.c:7823 - 7 0x1fd4768 in draw_dupli_objects_color /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:2193 - 8 0x1fd4b8b in draw_dupli_objects /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:2225 - 9 0x1fda296 in view3d_draw_objects /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:2840 - 10 0x1fe1e03 in view3d_main_region_draw_objects /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:3901 - 11 0x1fe30cc in view3d_main_region_draw /home/dal/workspace/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:4052 - 12 0x2abcd6b in ED_region_do_draw /home/dal/workspace/blender-git/blender/source/blender/editors/screen/area.c:518 - 13 0x1d1bf47 in wm_method_draw_triple /home/dal/workspace/blender-git/blender/source/blender/windowmanager/intern/wm_draw.c:557 - 14 0x1d1e597 in wm_draw_update /home/dal/workspace/blender-git/blender/source/blender/windowmanager/intern/wm_draw.c:956 - 15 0x1d0f882 in WM_main /home/dal/workspace/blender-git/blender/source/blender/windowmanager/intern/wm.c:495 - 16 0x1d05a07 in main /home/dal/workspace/blender-git/blender/source/creator/creator.c:527 - 17 0x7f7da39cf82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #18 0x1d04d98 in _start (/home/dal/workspace/blender-git/build_1/bin/blender+0x1d04d98) 0x61d00079fe7c is located 4 bytes to the left of 2360-byte region [0x61d00079fe80,0x61d0007a07b8) allocated by thread T15 here: - 0 0x7f7daa424121 in __interceptor_calloc ../../.././libsanitizer/asan/asan_malloc_linux.cc:54 - 1 0x4cbf775 in MEM_lockfree_callocN /home/dal/workspace/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:286 - 2 0x40280ee in ptcache_data_alloc /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/pointcache.c:2186 - 3 0x402d3e4 in ptcache_write /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/pointcache.c:2796 - 4 0x402e153 in BKE_ptcache_write /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/pointcache.c:2922 - 5 0x3fe7775 in system_step /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/particle_system.c:4014 - 6 0x3feaeb1 in particle_system_update /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/particle_system.c:4303 - 7 0x331980b in deformVerts /home/dal/workspace/blender-git/blender/source/blender/modifiers/intern/MOD_particlesystem.c:189 - 8 0x3ef2408 in modwrap_deformVerts /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/modifier.c:774 - 9 0x3b7e057 in mesh_calc_modifiers /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.c:1842 - 10 0x3b837d8 in mesh_build_data /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.c:2611 - 11 0x3b8426f in makeDerivedMesh /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.c:2708 - 12 0x3f785e1 in BKE_object_handle_data_update /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/object_update.c:201 - 13 0x3f5dc1c in BKE_object_handle_update_ex /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/object.c:2692 - 14 0x4056673 in scene_update_object_func /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/scene.c:1497 - 15 0x48d3259 in task_scheduler_thread_run /home/dal/workspace/blender-git/blender/source/blender/blenlib/intern/task.c:326 #16 0x7f7da3f836f9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76f9) Thread T15 created by T0 here: - 0 0x7f7daa3c6014 in __interceptor_pthread_create ../../.././libsanitizer/asan/asan_interceptors.cc:179 - 1 0x48d36ba in BLI_task_scheduler_create /home/dal/workspace/blender-git/blender/source/blender/blenlib/intern/task.c:377 - 2 0x48d68c1 in BLI_task_scheduler_get /home/dal/workspace/blender-git/blender/source/blender/blenlib/intern/threads.c:174 - 3 0x4056e3c in scene_update_objects /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/scene.c:1624 - 4 0x4057253 in scene_update_tagged_recursive /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/scene.c:1705 - 5 0x40579fc in BKE_scene_update_tagged /home/dal/workspace/blender-git/blender/source/blender/blenkernel/intern/scene.c:1808 - 6 0x1d214dc in wm_event_do_notifiers /home/dal/workspace/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:404 - 7 0x1d0f876 in WM_main /home/dal/workspace/blender-git/blender/source/blender/windowmanager/intern/wm.c:492 - 8 0x1d05a07 in main /home/dal/workspace/blender-git/blender/source/creator/creator.c:527 - 9 0x7f7da39cf82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) SUMMARY: AddressSanitizer: heap-buffer-overflow ../../.././libsanitizer/asan/asan_interceptors.cc:367 __asan_memcpy Shadow bytes around the buggy address: 0x0c3a800ebf70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a800ebf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a800ebf90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a800ebfa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a800ebfb0: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa =>0x0c3a800ebfc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa] 0x0c3a800ebfd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a800ebfe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a800ebff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a800ec000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a800ec010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==12713==ABORTING ``` [crash.zip](https://archive.blender.org/developer/F355453/crash.zip)

Alexander Romanov commented

2016-09-07 16:33:17 +02:00

Changed status to: 'Open'