Page MenuHome

Crash in Audaspace with some video file
Closed, ResolvedPublicBUG

Description

In current master, I get hard immediate crash in the sequencer when trying to use the 'raw' videos produced during the bconf, made a 1 sec snippet of it as a demo below (just download both in same place, open .blend file and try to play the video).

F7918850

ASAN report looks like this:

ead blend: /home/guest/Downloads/audaspace_crash.blend
/home/guest/blender/src/extern/audaspace/src/respec/LinearResampleReader.cpp:26:32: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/respec/LinearResampleReader.cpp:30:24: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/respec/LinearResampleReader.cpp:31:21: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/devices/SoftwareDevice.cpp:106:25: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:186:43: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:90:18: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:93:25: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:94:16: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:97:21: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:100:48: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:100:17: runtime error: load of address 0x5558f790c318 with insufficient space for an object of type 'const Channel *'
0x5558f790c318: note: pointer points here
 58 55 00 00  40 c1 7e d1 58 55 00 00  80 c1 7e d1 58 55 00 00  c0 c1 7e d1 58 55 00 00  00 c2 7e d1
              ^ 
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:114:46: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:114:15: runtime error: load of address 0x5558f790c378 with insufficient space for an object of type 'const float *'
0x5558f790c378: note: pointer points here
 58 55 00 00  e0 bf b8 d2 58 55 00 00  04 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00
              ^ 
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:117:5: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:123:21: runtime error: load of value 16, which is not a valid value for type 'Channels'
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:125:23: runtime error: load of value 3209236443, which is not a valid value for type 'Channel'
/home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:163:29: runtime error: load of value 16, which is not a valid value for type 'Channels'
=================================================================
==18347==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c0001dec80 at pc 0x5558c8a6dd28 bp 0x7ffce1acbd00 sp 0x7ffce1acbcf8
WRITE of size 4 at 0x60c0001dec80 thread T0
    #0 0x5558c8a6dd27 in aud::ChannelMapperReader::calculateMapping() /home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:163
    #1 0x5558c8a6f294 in aud::ChannelMapperReader::read(int&, bool&, float*) /home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:190
    #2 0x5558c8b224e3 in aud::SoftwareDevice::mix(unsigned char*, int) /home/guest/blender/src/extern/audaspace/src/devices/SoftwareDevice.cpp:750
    #3 0x5558c8b05e08 in aud::ReadDevice::read(unsigned char*, int) /home/guest/blender/src/extern/audaspace/src/devices/ReadDevice.cpp:49
    #4 0x5558c8ab6b11 in aud::SequenceReader::read(int&, bool&, float*) /home/guest/blender/src/extern/audaspace/src/sequence/SequenceReader.cpp:187
    #5 0x5558c8b8e75d in aud::OpenALDevice::OpenALHandle::OpenALHandle(aud::OpenALDevice*, int, std::shared_ptr<aud::IReader>, bool) /home/guest/blender/src/extern/audaspace/plugins/openal/OpenALDevice.cpp:134
    #6 0x5558c8bb3cce in aud::OpenALDevice::play(std::shared_ptr<aud::IReader>, bool) /home/guest/blender/src/extern/audaspace/plugins/openal/OpenALDevice.cpp:1324
    #7 0x5558c8bb45bc in aud::OpenALDevice::play(std::shared_ptr<aud::ISound>, bool) /home/guest/blender/src/extern/audaspace/plugins/openal/OpenALDevice.cpp:1344
    #8 0x5558c8ad1c74 in AUD_Device_play /home/guest/blender/src/extern/audaspace/bindings/C/AUD_Device.cpp:112
    #9 0x5558bb0bd6b5 in sound_start_play_scene /home/guest/blender/src/source/blender/blenkernel/intern/sound.c:726
    #10 0x5558bb0bdc58 in BKE_sound_play_scene /home/guest/blender/src/source/blender/blenkernel/intern/sound.c:744
    #11 0x5558bf42a5b1 in ED_screen_animation_play /home/guest/blender/src/source/blender/editors/screen/screen_ops.c:4618
    #12 0x5558bf42a984 in screen_animation_play_exec /home/guest/blender/src/source/blender/editors/screen/screen_ops.c:4643
    #13 0x5558bc438a14 in wm_operator_invoke /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:1453
    #14 0x5558bc440617 in wm_handler_operator_call /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2281
    #15 0x5558bc444467 in wm_handlers_do_keymap_with_keymap_handler /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2598
    #16 0x5558bc445c41 in wm_handlers_do_intern /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2735
    #17 0x5558bc448bbd in wm_handlers_do /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2997
    #18 0x5558bc44e85d in wm_event_do_handlers /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3450
    #19 0x5558bc415616 in WM_main /home/guest/blender/src/source/blender/windowmanager/intern/wm.c:417
    #20 0x5558ba5d5b92 in main /home/guest/blender/src/source/creator/creator.c:491
    #21 0x7f3b6e639bba in __libc_start_main ../csu/libc-start.c:308
    #22 0x5558ba5d4d69 in _start (/home/guest/blender/build_master_debug/bin/blender+0x24177d69)

0x60c0001dec80 is located 0 bytes to the right of 128-byte region [0x60c0001dec00,0x60c0001dec80)
allocated by thread T0 here:
    #0 0x7f3b735c90af in operator new(unsigned long) (/lib/x86_64-linux-gnu/libasan.so.5+0x1090af)
    #1 0x5558c8bb3c52 in aud::OpenALDevice::play(std::shared_ptr<aud::IReader>, bool) /home/guest/blender/src/extern/audaspace/plugins/openal/OpenALDevice.cpp:1324
    #2 0x5558c8bb45bc in aud::OpenALDevice::play(std::shared_ptr<aud::ISound>, bool) /home/guest/blender/src/extern/audaspace/plugins/openal/OpenALDevice.cpp:1344
    #3 0x5558c8ad1c74 in AUD_Device_play /home/guest/blender/src/extern/audaspace/bindings/C/AUD_Device.cpp:112
    #4 0x5558bb0bd6b5 in sound_start_play_scene /home/guest/blender/src/source/blender/blenkernel/intern/sound.c:726
    #5 0x5558bb0bdc58 in BKE_sound_play_scene /home/guest/blender/src/source/blender/blenkernel/intern/sound.c:744
    #6 0x5558bf42a5b1 in ED_screen_animation_play /home/guest/blender/src/source/blender/editors/screen/screen_ops.c:4618
    #7 0x5558bf42a984 in screen_animation_play_exec /home/guest/blender/src/source/blender/editors/screen/screen_ops.c:4643
    #8 0x5558bc438a14 in wm_operator_invoke /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:1453
    #9 0x5558bc440617 in wm_handler_operator_call /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2281
    #10 0x5558bc444467 in wm_handlers_do_keymap_with_keymap_handler /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2598
    #11 0x5558bc445c41 in wm_handlers_do_intern /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2735
    #12 0x5558bc448bbd in wm_handlers_do /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2997
    #13 0x5558bc44e85d in wm_event_do_handlers /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3450
    #14 0x5558bc415616 in WM_main /home/guest/blender/src/source/blender/windowmanager/intern/wm.c:417
    #15 0x5558ba5d5b92 in main /home/guest/blender/src/source/creator/creator.c:491
    #16 0x7f3b6e639bba in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/guest/blender/src/extern/audaspace/src/respec/ChannelMapperReader.cpp:163 in aud::ChannelMapperReader::calculateMapping()
Shadow bytes around the buggy address:
  0x0c1880033d40: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c1880033d50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1880033d60: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c1880033d70: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c1880033d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c1880033d90:[fa]fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c1880033da0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c1880033db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1880033dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1880033dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1880033de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==18347==ABORTING

Event Timeline

Bastien Montagne (mont29) triaged this task as High priority.Nov 3 2019, 6:43 PM
Bastien Montagne (mont29) created this task.

Note: set priority to 'high' in hope this can be easily fixed quickly (cannot render the last video for the bconf otherwise), feel free to lower prio if this issue is not easily fixable. ;)

runtime error: load of value 16, which is not a valid value for type 'Channels'

That's weird, because the file indeed contains 16-channel audio. We had this in De Balie as well as in Compagnie Theater, so it seems to be some form of standard. But yes, the Audaspace source only supports up to 8 channels. I'm working on a way to extend that.