heap-use-after-free when resizing image empty #57927

New Issue

Sergey Sharybin · 2018-11-19T12:26:32+01:00

Sergey Sharybin commented

2018-11-19 12:26:32 +01:00

System Information

Debian Buster 64bit, GTX1080 390.87

Blender Version

Broken: b0c463a274
Worked: don't know

Short description of error

ASAN instantly reports issue when trying to resize empty-image (or image-empty?)

Exact steps for others to reproduce the error

Noticed with the file from #57889 Burger.blend. Simple resize the empty and get:

P826: (An Untitled Masterwork)

Read blend: /home/sergey/Downloads/Burger.blend
=================================================================
==12331==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000109354 at pc 0x559e833b656b bp 0x7fff8e0ae900 sp 0x7fff8e0ae8f8
READ of size 4 at 0x610000109354 thread T0
    #0 0x559e833b656a in GPU_texture_bound_number /home/sergey/src/blender/blender/source/blender/gpu/intern/gpu_texture.c:1245
    #1 0x559e834537df in bind_texture /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager_exec.c:875
    #2 0x559e83455797 in draw_shgroup /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager_exec.c:1068
    #3 0x559e8345789c in drw_draw_pass_ex /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager_exec.c:1290
    #4 0x559e83457c60 in DRW_draw_pass /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager_exec.c:1323
    #5 0x559e8349c0ca in OBJECT_draw_scene /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:2921
    #6 0x559e83438b55 in drw_engines_draw_scene /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1033
    #7 0x559e8343acf3 in DRW_draw_render_loop_ex /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1479
    #8 0x559e8343a22f in DRW_draw_view /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1367
    #9 0x559e817be23a in view3d_draw_view /home/sergey/src/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1319
    #10 0x559e817be332 in view3d_main_region_draw /home/sergey/src/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1340
    #11 0x559e823b2b74 in ED_region_do_draw /home/sergey/src/blender/blender/source/blender/editors/screen/area.c:529
    #12 0x559e814a8b76 in wm_draw_window_offscreen /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:572
    #13 0x559e814a96b3 in wm_draw_window /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:698
    #14 0x559e814aa0f9 in wm_draw_update /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:852
    #15 0x559e814a2413 in WM_main /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm.c:433
    #16 0x559e81497bad in main /home/sergey/src/blender/blender/source/creator/creator.c:525
    #17 0x7efe809b1b16 in __libc_start_main ../csu/libc-start.c:310
    #18 0x559e81496f89 in _start (/home/sergey/src/blender/build/cmake-debug/bin/blender+0x39e2f89)

0x610000109354 is located 20 bytes inside of 184-byte region [0x610000109340,0x6100001093f8)
freed by thread T0 here:
    #0 0x7efe818f1b50 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8b50)
    #1 0x559e84d14c10 in MEM_lockfree_freeN /home/sergey/src/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:164
    #2 0x559e833b7be8 in GPU_texture_free /home/sergey/src/blender/blender/source/blender/gpu/intern/gpu_texture.c:1383
    #3 0x559e83381bd1 in GPU_free_image /home/sergey/src/blender/blender/source/blender/gpu/intern/gpu_draw.c:1235
    #4 0x559e83ab378a in BKE_image_free_buffers_ex /home/sergey/src/blender/blender/source/blender/blenkernel/intern/image.c:256
    #5 0x559e83ab3806 in BKE_image_free_buffers /home/sergey/src/blender/blender/source/blender/blenkernel/intern/image.c:268
    #6 0x559e83ac56c5 in image_load_image_file /home/sergey/src/blender/blender/source/blender/blenkernel/intern/image.c:3475
    #7 0x559e83ac8c60 in image_acquire_ibuf /home/sergey/src/blender/blender/source/blender/blenkernel/intern/image.c:3934
    #8 0x559e83ac9501 in BKE_image_acquire_ibuf /home/sergey/src/blender/blender/source/blender/blenkernel/intern/image.c:4002
    #9 0x559e83acb30a in BKE_image_get_size /home/sergey/src/blender/blender/source/blender/blenkernel/intern/image.c:4312
    #10 0x559e83482afb in image_calc_aspect /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:828
    #11 0x559e834833d3 in DRW_shgroup_empty_image /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:901
    #12 0x559e8348f32f in DRW_shgroup_empty /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:1890
    #13 0x559e8349abe8 in OBJECT_cache_populate /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:2777
    #14 0x559e83438795 in drw_engines_cache_populate /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:979
    #15 0x559e8343a963 in DRW_draw_render_loop_ex /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1430
    #16 0x559e8343a22f in DRW_draw_view /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1367
    #17 0x559e817be23a in view3d_draw_view /home/sergey/src/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1319
    #18 0x559e817be332 in view3d_main_region_draw /home/sergey/src/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1340
    #19 0x559e823b2b74 in ED_region_do_draw /home/sergey/src/blender/blender/source/blender/editors/screen/area.c:529
    #20 0x559e814a8b76 in wm_draw_window_offscreen /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:572
    #21 0x559e814a96b3 in wm_draw_window /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:698
    #22 0x559e814aa0f9 in wm_draw_update /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:852
    #23 0x559e814a2413 in WM_main /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm.c:433
    #24 0x559e81497bad in main /home/sergey/src/blender/blender/source/creator/creator.c:525
    #25 0x7efe809b1b16 in __libc_start_main ../csu/libc-start.c:310

previously allocated by thread T0 here:
    #0 0x7efe818f20b8 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe90b8)
    #1 0x559e84d15095 in MEM_lockfree_callocN /home/sergey/src/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:282
    #2 0x559e833b2854 in GPU_texture_from_bindcode /home/sergey/src/blender/blender/source/blender/gpu/intern/gpu_texture.c:805
    #3 0x559e8337c0d4 in GPU_texture_from_blender /home/sergey/src/blender/blender/source/blender/gpu/intern/gpu_draw.c:304
    #4 0x559e8348324a in DRW_shgroup_empty_image /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:891
    #5 0x559e8348f32f in DRW_shgroup_empty /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:1890
    #6 0x559e8349abe8 in OBJECT_cache_populate /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:2777
    #7 0x559e83438795 in drw_engines_cache_populate /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:979
    #8 0x559e8343a963 in DRW_draw_render_loop_ex /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1430
    #9 0x559e8343a22f in DRW_draw_view /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1367
    #10 0x559e817be23a in view3d_draw_view /home/sergey/src/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1319
    #11 0x559e817be332 in view3d_main_region_draw /home/sergey/src/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1340
    #12 0x559e823b2b74 in ED_region_do_draw /home/sergey/src/blender/blender/source/blender/editors/screen/area.c:529
    #13 0x559e814a8b76 in wm_draw_window_offscreen /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:572
    #14 0x559e814a96b3 in wm_draw_window /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:698
    #15 0x559e814aa0f9 in wm_draw_update /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:852
    #16 0x559e814a2413 in WM_main /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm.c:433
    #17 0x559e81497bad in main /home/sergey/src/blender/blender/source/creator/creator.c:525
    #18 0x7efe809b1b16 in __libc_start_main ../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-use-after-free /home/sergey/src/blender/blender/source/blender/gpu/intern/gpu_texture.c:1245 in GPU_texture_bound_number
Shadow bytes around the buggy address:
  0x0c2080019210: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c2080019220: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c2080019230: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c2080019240: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c2080019250: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
=>0x0c2080019260: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd
  0x0c2080019270: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c2080019280: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c2080019290: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c20800192a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c20800192b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==12331==ABORTING
Aborted

**System Information** Debian Buster 64bit, GTX1080 390.87 **Blender Version** Broken: b0c463a274 Worked: don't know **Short description of error** ASAN instantly reports issue when trying to resize empty-image (or image-empty?) **Exact steps for others to reproduce the error** Noticed with the file from #57889 [Burger.blend](https://archive.blender.org/developer/F5635365/Burger.blend). Simple resize the empty and get: [P826: (An Untitled Masterwork)](https://archive.blender.org/developer/P826.txt) ``` Read blend: /home/sergey/Downloads/Burger.blend ================================================================= ==12331==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000109354 at pc 0x559e833b656b bp 0x7fff8e0ae900 sp 0x7fff8e0ae8f8 READ of size 4 at 0x610000109354 thread T0 #0 0x559e833b656a in GPU_texture_bound_number /home/sergey/src/blender/blender/source/blender/gpu/intern/gpu_texture.c:1245 #1 0x559e834537df in bind_texture /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager_exec.c:875 #2 0x559e83455797 in draw_shgroup /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager_exec.c:1068 #3 0x559e8345789c in drw_draw_pass_ex /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager_exec.c:1290 #4 0x559e83457c60 in DRW_draw_pass /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager_exec.c:1323 #5 0x559e8349c0ca in OBJECT_draw_scene /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:2921 #6 0x559e83438b55 in drw_engines_draw_scene /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1033 #7 0x559e8343acf3 in DRW_draw_render_loop_ex /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1479 #8 0x559e8343a22f in DRW_draw_view /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1367 #9 0x559e817be23a in view3d_draw_view /home/sergey/src/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1319 #10 0x559e817be332 in view3d_main_region_draw /home/sergey/src/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1340 #11 0x559e823b2b74 in ED_region_do_draw /home/sergey/src/blender/blender/source/blender/editors/screen/area.c:529 #12 0x559e814a8b76 in wm_draw_window_offscreen /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:572 #13 0x559e814a96b3 in wm_draw_window /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:698 #14 0x559e814aa0f9 in wm_draw_update /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:852 #15 0x559e814a2413 in WM_main /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm.c:433 #16 0x559e81497bad in main /home/sergey/src/blender/blender/source/creator/creator.c:525 #17 0x7efe809b1b16 in __libc_start_main ../csu/libc-start.c:310 #18 0x559e81496f89 in _start (/home/sergey/src/blender/build/cmake-debug/bin/blender+0x39e2f89) 0x610000109354 is located 20 bytes inside of 184-byte region [0x610000109340,0x6100001093f8) freed by thread T0 here: #0 0x7efe818f1b50 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8b50) #1 0x559e84d14c10 in MEM_lockfree_freeN /home/sergey/src/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:164 #2 0x559e833b7be8 in GPU_texture_free /home/sergey/src/blender/blender/source/blender/gpu/intern/gpu_texture.c:1383 #3 0x559e83381bd1 in GPU_free_image /home/sergey/src/blender/blender/source/blender/gpu/intern/gpu_draw.c:1235 #4 0x559e83ab378a in BKE_image_free_buffers_ex /home/sergey/src/blender/blender/source/blender/blenkernel/intern/image.c:256 #5 0x559e83ab3806 in BKE_image_free_buffers /home/sergey/src/blender/blender/source/blender/blenkernel/intern/image.c:268 #6 0x559e83ac56c5 in image_load_image_file /home/sergey/src/blender/blender/source/blender/blenkernel/intern/image.c:3475 #7 0x559e83ac8c60 in image_acquire_ibuf /home/sergey/src/blender/blender/source/blender/blenkernel/intern/image.c:3934 #8 0x559e83ac9501 in BKE_image_acquire_ibuf /home/sergey/src/blender/blender/source/blender/blenkernel/intern/image.c:4002 #9 0x559e83acb30a in BKE_image_get_size /home/sergey/src/blender/blender/source/blender/blenkernel/intern/image.c:4312 #10 0x559e83482afb in image_calc_aspect /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:828 #11 0x559e834833d3 in DRW_shgroup_empty_image /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:901 #12 0x559e8348f32f in DRW_shgroup_empty /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:1890 #13 0x559e8349abe8 in OBJECT_cache_populate /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:2777 #14 0x559e83438795 in drw_engines_cache_populate /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:979 #15 0x559e8343a963 in DRW_draw_render_loop_ex /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1430 #16 0x559e8343a22f in DRW_draw_view /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1367 #17 0x559e817be23a in view3d_draw_view /home/sergey/src/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1319 #18 0x559e817be332 in view3d_main_region_draw /home/sergey/src/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1340 #19 0x559e823b2b74 in ED_region_do_draw /home/sergey/src/blender/blender/source/blender/editors/screen/area.c:529 #20 0x559e814a8b76 in wm_draw_window_offscreen /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:572 #21 0x559e814a96b3 in wm_draw_window /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:698 #22 0x559e814aa0f9 in wm_draw_update /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:852 #23 0x559e814a2413 in WM_main /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm.c:433 #24 0x559e81497bad in main /home/sergey/src/blender/blender/source/creator/creator.c:525 #25 0x7efe809b1b16 in __libc_start_main ../csu/libc-start.c:310 previously allocated by thread T0 here: #0 0x7efe818f20b8 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe90b8) #1 0x559e84d15095 in MEM_lockfree_callocN /home/sergey/src/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:282 #2 0x559e833b2854 in GPU_texture_from_bindcode /home/sergey/src/blender/blender/source/blender/gpu/intern/gpu_texture.c:805 #3 0x559e8337c0d4 in GPU_texture_from_blender /home/sergey/src/blender/blender/source/blender/gpu/intern/gpu_draw.c:304 #4 0x559e8348324a in DRW_shgroup_empty_image /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:891 #5 0x559e8348f32f in DRW_shgroup_empty /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:1890 #6 0x559e8349abe8 in OBJECT_cache_populate /home/sergey/src/blender/blender/source/blender/draw/modes/object_mode.c:2777 #7 0x559e83438795 in drw_engines_cache_populate /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:979 #8 0x559e8343a963 in DRW_draw_render_loop_ex /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1430 #9 0x559e8343a22f in DRW_draw_view /home/sergey/src/blender/blender/source/blender/draw/intern/draw_manager.c:1367 #10 0x559e817be23a in view3d_draw_view /home/sergey/src/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1319 #11 0x559e817be332 in view3d_main_region_draw /home/sergey/src/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1340 #12 0x559e823b2b74 in ED_region_do_draw /home/sergey/src/blender/blender/source/blender/editors/screen/area.c:529 #13 0x559e814a8b76 in wm_draw_window_offscreen /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:572 #14 0x559e814a96b3 in wm_draw_window /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:698 #15 0x559e814aa0f9 in wm_draw_update /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm_draw.c:852 #16 0x559e814a2413 in WM_main /home/sergey/src/blender/blender/source/blender/windowmanager/intern/wm.c:433 #17 0x559e81497bad in main /home/sergey/src/blender/blender/source/creator/creator.c:525 #18 0x7efe809b1b16 in __libc_start_main ../csu/libc-start.c:310 SUMMARY: AddressSanitizer: heap-use-after-free /home/sergey/src/blender/blender/source/blender/gpu/intern/gpu_texture.c:1245 in GPU_texture_bound_number Shadow bytes around the buggy address: 0x0c2080019210: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x0c2080019220: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c2080019230: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x0c2080019240: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c2080019250: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa =>0x0c2080019260: fa fa fa fa fa fa fa fa fd fd[fd]fd fd fd fd fd 0x0c2080019270: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x0c2080019280: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c2080019290: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x0c20800192a0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c20800192b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==12331==ABORTING Aborted ```

Sergey Sharybin commented

2018-11-19 12:26:32 +01:00

Added subscriber: @Sergey