Crash in 2.8x lookdev #57948

New Issue

Campbell Barton · 2018-11-20T06:21:55+01:00

Campbell Barton commented

2018-11-20 06:21:55 +01:00

Lookdev currently has a stack overflow reading past the end of an array,

==18646==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff0784df50 at pc 0x559812eaf147 bp 0x7fff0784de30 sp 0x7fff0784de20
READ of size 4 at 0x7fff0784df50 thread T0
    - 0 0x559812eaf146 in mul_v3_v3fl /src/blender/source/blender/blenlib/intern/math_vector_inline.c:436
    - 1 0x559812eba617 in studiolight_spherical_harmonics_apply_band_factors /src/blender/source/blender/blenkernel/intern/studiolight.c:643
    - 2 0x559812eba828 in studiolight_calculate_diffuse_light /src/blender/source/blender/blenkernel/intern/studiolight.c:659
    - 3 0x559812ebee4a in BKE_studiolight_ensure_flag /src/blender/source/blender/blenkernel/intern/studiolight.c:1137
    - 4 0x559812ebb1dd in studiolight_calculate_irradiance_equirect_image /src/blender/source/blender/blenkernel/intern/studiolight.c:780
    - 5 0x559812ebeea5 in BKE_studiolight_ensure_flag /src/blender/source/blender/blenkernel/intern/studiolight.c:1148
    - 6 0x559812eb5de0 in studiolight_create_equirect_irradiance_gputexture /src/blender/source/blender/blenkernel/intern/studiolight.c:297
    - 7 0x559812ebee7a in BKE_studiolight_ensure_flag /src/blender/source/blender/blenkernel/intern/studiolight.c:1144
    - 8 0x559812027bf6 in EEVEE_lookdev_cache_init /src/blender/source/blender/draw/engines/eevee/eevee_lookdev.c:126
    - 9 0x559812032008 in EEVEE_materials_cache_init /src/blender/source/blender/draw/engines/eevee/eevee_materials.c:967
    - 10 0x559811fcd1bd in eevee_cache_init /src/blender/source/blender/draw/engines/eevee/eevee_engine.c:119
    - 11 0x559811f10fea in drw_engines_cache_init /src/blender/source/blender/draw/intern/draw_manager.c:939
    - 12 0x559811f14feb in DRW_draw_render_loop_ex /src/blender/source/blender/draw/intern/draw_manager.c:1423
    - 13 0x559811f1470e in DRW_draw_view /src/blender/source/blender/draw/intern/draw_manager.c:1367
    - 14 0x55980f8855b5 in view3d_draw_view /src/blender/source/blender/editors/space_view3d/view3d_draw.c:1319
    - 15 0x55980f885756 in view3d_main_region_draw /src/blender/source/blender/editors/space_view3d/view3d_draw.c:1340
    - 16 0x559810c2f7ca in ED_region_do_draw /src/blender/source/blender/editors/screen/area.c:529
    - 17 0x55980f3411a3 in wm_draw_window_offscreen /src/blender/source/blender/windowmanager/intern/wm_draw.c:572
    - 18 0x55980f34247f in wm_draw_window /src/blender/source/blender/windowmanager/intern/wm_draw.c:698
    - 19 0x55980f34356e in wm_draw_update /src/blender/source/blender/windowmanager/intern/wm_draw.c:852
    - 20 0x55980f335173 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:433
    - 21 0x55980f325cb7 in main /src/blender/source/creator/creator.c:525
    - 22 0x7fb63974c222 in __libc_start_main (/usr/lib/libc.so.6+0x24222)
    - 23 0x55980f324e8d in _start (/src/cmake_debug/bin/blender+0x872ae8d)

Address 0x7fff0784df50 is located in stack of thread T0 at offset 80 in frame
    #0 0x559812eba6bb in studiolight_calculate_diffuse_light /src/blender/source/blender/blenkernel/intern/studiolight.c:651

  This frame has 1 object(s):
    [32, 80) 'sh_coefs' <== Memory access at offset 80 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext

Enable lookdev with asan enabled, this shows the error immediately.

Lookdev currently has a stack overflow reading past the end of an array, ``` ==18646==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff0784df50 at pc 0x559812eaf147 bp 0x7fff0784de30 sp 0x7fff0784de20 READ of size 4 at 0x7fff0784df50 thread T0 - 0 0x559812eaf146 in mul_v3_v3fl /src/blender/source/blender/blenlib/intern/math_vector_inline.c:436 - 1 0x559812eba617 in studiolight_spherical_harmonics_apply_band_factors /src/blender/source/blender/blenkernel/intern/studiolight.c:643 - 2 0x559812eba828 in studiolight_calculate_diffuse_light /src/blender/source/blender/blenkernel/intern/studiolight.c:659 - 3 0x559812ebee4a in BKE_studiolight_ensure_flag /src/blender/source/blender/blenkernel/intern/studiolight.c:1137 - 4 0x559812ebb1dd in studiolight_calculate_irradiance_equirect_image /src/blender/source/blender/blenkernel/intern/studiolight.c:780 - 5 0x559812ebeea5 in BKE_studiolight_ensure_flag /src/blender/source/blender/blenkernel/intern/studiolight.c:1148 - 6 0x559812eb5de0 in studiolight_create_equirect_irradiance_gputexture /src/blender/source/blender/blenkernel/intern/studiolight.c:297 - 7 0x559812ebee7a in BKE_studiolight_ensure_flag /src/blender/source/blender/blenkernel/intern/studiolight.c:1144 - 8 0x559812027bf6 in EEVEE_lookdev_cache_init /src/blender/source/blender/draw/engines/eevee/eevee_lookdev.c:126 - 9 0x559812032008 in EEVEE_materials_cache_init /src/blender/source/blender/draw/engines/eevee/eevee_materials.c:967 - 10 0x559811fcd1bd in eevee_cache_init /src/blender/source/blender/draw/engines/eevee/eevee_engine.c:119 - 11 0x559811f10fea in drw_engines_cache_init /src/blender/source/blender/draw/intern/draw_manager.c:939 - 12 0x559811f14feb in DRW_draw_render_loop_ex /src/blender/source/blender/draw/intern/draw_manager.c:1423 - 13 0x559811f1470e in DRW_draw_view /src/blender/source/blender/draw/intern/draw_manager.c:1367 - 14 0x55980f8855b5 in view3d_draw_view /src/blender/source/blender/editors/space_view3d/view3d_draw.c:1319 - 15 0x55980f885756 in view3d_main_region_draw /src/blender/source/blender/editors/space_view3d/view3d_draw.c:1340 - 16 0x559810c2f7ca in ED_region_do_draw /src/blender/source/blender/editors/screen/area.c:529 - 17 0x55980f3411a3 in wm_draw_window_offscreen /src/blender/source/blender/windowmanager/intern/wm_draw.c:572 - 18 0x55980f34247f in wm_draw_window /src/blender/source/blender/windowmanager/intern/wm_draw.c:698 - 19 0x55980f34356e in wm_draw_update /src/blender/source/blender/windowmanager/intern/wm_draw.c:852 - 20 0x55980f335173 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:433 - 21 0x55980f325cb7 in main /src/blender/source/creator/creator.c:525 - 22 0x7fb63974c222 in __libc_start_main (/usr/lib/libc.so.6+0x24222) - 23 0x55980f324e8d in _start (/src/cmake_debug/bin/blender+0x872ae8d) Address 0x7fff0784df50 is located in stack of thread T0 at offset 80 in frame #0 0x559812eba6bb in studiolight_calculate_diffuse_light /src/blender/source/blender/blenkernel/intern/studiolight.c:651 This frame has 1 object(s): [32, 80) 'sh_coefs' <== Memory access at offset 80 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext ``` Enable lookdev with asan enabled, this shows the error immediately.

Campbell Barton commented

2018-11-20 06:21:55 +01:00

Added subscriber: @ideasman42