Memory corruption during extrusions of overlapping edges (crashes 2.93 in one case) #89269

New Issue

Fen · 2021-06-18T21:26:39+02:00

Fen commented

2021-06-18 21:26:39 +02:00

System Information
Operating system: Windows-10-10.0.19041-SP0 64 Bits
Graphics card: GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 446.14

Blender Version
Broken: version: 3.0.0 Alpha, branch: master, commit date: 2021-06-18 15:20, hash: d52b7dbe26
Worked: Not sure. The relevant code hasn't changed since late last year.

Short description of error
With AddressSanitizer enabled, the attached .blend file causes a crash when extruding with the "Dissolve Orthogonal Edges" option enabled.

Also, see the comment below for another case that causes a crash in release builds.

Exact steps for others to reproduce the error

Open the attached file
Select the "Bad" vertex group -- the vertices are already selected, but when the file is loaded, the edge doesn't get included due to a separate bug)
Extrude (E) anywhere
In the Extrude Region and Move panel, enable Dissolve Orthogonal Edges
AddressSanitizer causes a crash

extrude-heap.blend

This specific case seems benign if AddressSanitizer is not present.

The geometry data is just an edge extruded on top of itself. data.validate() doesn't complain about it.

SUMMARY: AddressSanitizer: heap-buffer-overflow D:\blender-git\blender\source\blender\bmesh\operators\bmo_extrude.c:585 in bmo_extrude_face_region_exec
Shadow bytes around the buggy address:
  0x038557f7d5a0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x038557f7d5b0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x038557f7d5c0: fa fa fd fd fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x038557f7d5d0: fa fa 00 00 fa fa 00 04 fa fa fd fd fa fa 00 00
  0x038557f7d5e0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
=>0x038557f7d5f0: fa fa 00 00[fa]fa fd fa fa fa fd fa fa fa 04 fa
  0x038557f7d600: fa fa 04 fa fa fa 01 fa fa fa 01 fa fa fa 00 fa
  0x038557f7d610: fa fa 04 fa fa fa 00 04 fa fa 04 fa fa fa 04 fa
  0x038557f7d620: fa fa 00 fa fa fa 00 fa fa fa 04 fa fa fa 00 fa
  0x038557f7d630: fa fa 00 fa fa fa 04 fa fa fa 00 fa fa fa 00 00
  0x038557f7d640: fa fa 00 fa fa fa 04 fa fa fa 00 fa fa fa 00 04

**System Information** Operating system: Windows-10-10.0.19041-SP0 64 Bits Graphics card: GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 446.14 **Blender Version** Broken: version: 3.0.0 Alpha, branch: master, commit date: 2021-06-18 15:20, hash: `d52b7dbe26` Worked: Not sure. The relevant code hasn't changed since late last year. **Short description of error** With AddressSanitizer enabled, the attached .blend file causes a crash when extruding with the "Dissolve Orthogonal Edges" option enabled. Also, see the comment below for another case that causes a crash in release builds. **Exact steps for others to reproduce the error** 1. Open the attached file 2. *Select the "Bad" vertex group* -- the vertices are already selected, but when the file is loaded, the edge doesn't get included due to a separate bug) 3. Extrude (E) anywhere 4. In the *Extrude Region and Move* panel, enable *Dissolve Orthogonal Edges* 5. AddressSanitizer causes a crash [extrude-heap.blend](https://archive.blender.org/developer/F10180596/extrude-heap.blend) This specific case seems benign if AddressSanitizer is not present. The geometry data is just an edge extruded on top of itself. `data.validate()` doesn't complain about it. ``` SUMMARY: AddressSanitizer: heap-buffer-overflow D:\blender-git\blender\source\blender\bmesh\operators\bmo_extrude.c:585 in bmo_extrude_face_region_exec Shadow bytes around the buggy address: 0x038557f7d5a0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x038557f7d5b0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x038557f7d5c0: fa fa fd fd fa fa 00 00 fa fa 00 00 fa fa 00 00 0x038557f7d5d0: fa fa 00 00 fa fa 00 04 fa fa fd fd fa fa 00 00 0x038557f7d5e0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00 =>0x038557f7d5f0: fa fa 00 00[fa]fa fd fa fa fa fd fa fa fa 04 fa 0x038557f7d600: fa fa 04 fa fa fa 01 fa fa fa 01 fa fa fa 00 fa 0x038557f7d610: fa fa 04 fa fa fa 00 04 fa fa 04 fa fa fa 04 fa 0x038557f7d620: fa fa 00 fa fa fa 00 fa fa fa 04 fa fa fa 00 fa 0x038557f7d630: fa fa 00 fa fa fa 04 fa fa fa 00 fa fa fa 00 00 0x038557f7d640: fa fa 00 fa fa fa 04 fa fa fa 00 fa fa fa 00 04 ```

Fen commented

2021-06-18 21:26:39 +02:00

Added subscriber: @chemicalcrux

Fen commented

2021-06-21 19:18:34 +02:00

I have gotten an actual crash on the 2.93 release build. I think something is getting corrupted -- it causes undoing and reverting to silently crash Blender.

extrude-crash.blend

Here is the offending file. Run the script to execute bpy.ops.mesh.extrude_manifold() (all default parameters) on the currently-selected vertices. It's a little inconsistent at this point, but undoing reliably causes a crash.

On my 3.0 debug build, AddressSanitizer detects the error at a slightly different location. Here's the output:

SUMMARY: AddressSanitizer: heap-buffer-overflow D:\blender-git\blender\source\blender\bmesh\operators\bmo_extrude.c:581 in bmo_extrude_face_region_exec
Shadow bytes around the buggy address:
  0x04381ccb9f10: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x04381ccb9f20: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x04381ccb9f30: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
  0x04381ccb9f40: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
  0x04381ccb9f50: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 00
=>0x04381ccb9f60:[fa]fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x04381ccb9f70: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
  0x04381ccb9f80: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x04381ccb9f90: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x04381ccb9fa0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
  0x04381ccb9fb0: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd

I have gotten an actual crash on the 2.93 release build. I think something is getting corrupted -- it causes undoing and reverting to silently crash Blender. [extrude-crash.blend](https://archive.blender.org/developer/F10186846/extrude-crash.blend) Here is the offending file. Run the script to execute `bpy.ops.mesh.extrude_manifold()` (all default parameters) on the currently-selected vertices. It's a little inconsistent at this point, but undoing reliably causes a crash. On my 3.0 debug build, AddressSanitizer detects the error at a slightly different location. Here's the output: ``` SUMMARY: AddressSanitizer: heap-buffer-overflow D:\blender-git\blender\source\blender\bmesh\operators\bmo_extrude.c:581 in bmo_extrude_face_region_exec Shadow bytes around the buggy address: 0x04381ccb9f10: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd 0x04381ccb9f20: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa 0x04381ccb9f30: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa 0x04381ccb9f40: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 0x04381ccb9f50: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 00 =>0x04381ccb9f60:[fa]fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa 0x04381ccb9f70: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd 0x04381ccb9f80: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd 0x04381ccb9f90: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa 0x04381ccb9fa0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd 0x04381ccb9fb0: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd ```

Fen changed title from ~~AddressSanitizer reports a buffer overflow for extrusions of overlapping edges with Dissolve Orthogonal Edges checked~~ to Memory corruption during extrusions of overlapping edges (crashes 2.93 in one case)

2021-06-21 19:20:11 +02:00

Germano Cavalcante commented

2021-06-23 16:04:35 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'

Germano Cavalcante self-assigned this 2021-06-23 16:04:35 +02:00

Germano Cavalcante commented

2021-06-23 16:05:08 +02:00

Thanks for the report, I can confirm.