Programmatically creating a link involving a blank group input/output socket causes a UAF #89436

New Issue

Fen · 2021-06-25T19:32:51+02:00

Fen commented

2021-06-25 19:32:51 +02:00

System Information
Operating system: Windows-10-10.0.19041-SP0 64 Bits
Graphics card: GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 446.14

Blender Version
Broken: version: 3.0.0 Alpha, branch: master, commit date: 2021-06-25 16:47, hash: 23042a3fb1
Also occurs in the 2.93.1 debug build

Short description of error
Group Input and Group Output nodes have blank sockets that can be used to automatically create a new group input or group output by plugging them into something. Trying to do this via NodeTree.links.new() causes a use-after-free in a debug build.

Exact steps for others to reproduce the error

Open the attached file
Run the script
AddressSanitizer causes a crash

group-socket-uaf.blend

AddressSanitizer output: P2214

Everything works as expected in a release build: a new group input or group output is correctly created.

This also happens if you try to directly create an output or input on the Group Input / Group Output sockets, but it happens in a different place: P2215 . I can spin that out into a separate task if needed.

Creating inputs or outputs on the node group (which I'm pretty sure is what you're supposed to be doing) works fine.

**System Information** Operating system: Windows-10-10.0.19041-SP0 64 Bits Graphics card: GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 446.14 **Blender Version** Broken: version: 3.0.0 Alpha, branch: master, commit date: 2021-06-25 16:47, hash: `23042a3fb1` Also occurs in the 2.93.1 debug build **Short description of error** Group Input and Group Output nodes have blank sockets that can be used to automatically create a new group input or group output by plugging them into something. Trying to do this via `NodeTree.links.new()` causes a use-after-free in a debug build. **Exact steps for others to reproduce the error** 1. Open the attached file 2. Run the script 3. AddressSanitizer causes a crash [group-socket-uaf.blend](https://archive.blender.org/developer/F10202379/group-socket-uaf.blend) AddressSanitizer output: [P2214](https://archive.blender.org/developer/P2214.txt) Everything works as expected in a release build: a new group input or group output is correctly created. This also happens if you try to directly create an output or input on the Group Input / Group Output sockets, but it happens in a different place: [P2215](https://archive.blender.org/developer/P2215.txt) . I can spin that out into a separate task if needed. Creating inputs or outputs on the *node group* (which I'm pretty sure is what you're supposed to be doing) works fine.

Fen commented

2021-06-25 19:32:51 +02:00

Added subscriber: @chemicalcrux

Philipp Oeser commented

2021-06-29 12:59:04 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'

Philipp Oeser commented

2021-06-29 13:35:09 +02:00

Added subscriber: @lichtwerk

Philipp Oeser self-assigned this 2021-06-29 13:35:09 +02:00

Philipp Oeser commented

2021-06-29 13:35:09 +02:00

Note 513066e8ad is related.

Since above commit, node_group_output_update can remove the link and make a new one, so relying on a valid link in rna_NodeTree_link_new does not work.
Could be a simple fix, will check.

Note 513066e8ad is related. Since above commit, `node_group_output_update` can remove the link and make a new one, so relying on a valid link in `rna_NodeTree_link_new` does not work. Could be a simple fix, will check.

Philipp Oeser removed their assignment 2021-07-15 13:08:29 +02:00

Philipp Oeser commented

2021-07-15 13:08:29 +02:00

Since D11737 might be a bit of a dead end (there is an additional issue in the patch that I have not been able to solve), will step down to not block others...

Since [D11737](https://archive.blender.org/developer/D11737) might be a bit of a dead end (there is an additional issue in the patch that I have not been able to solve), will step down to not block others...

Philipp Oeser removed the

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Programmatically creating a link involving a blank group input/output socket causes a UAF #89436