User after free when opening file after Blender starts #92252

New Issue

Hans Goudey · 2021-10-15T23:54:47+02:00

Hans Goudey commented

2021-10-15 23:54:47 +02:00

System Information
Operating system: Linux-5.14.11-200.fc34.x86_64-x86_64-with-glibc2.33 64 Bits
Graphics card: NVIDIA GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 470.74

Blender Version
Broken: version: 3.0.0 Alpha, branch: Unknown, commit date: Unknown Unknown, hash: rBUnknown
Worked: Caused by 6e4ab5b761

Exact steps for others to reproduce the error

Start Blender with factory startup
Click on any file from the recent file list in the splash screen, or "Recent Files" in the file menu, or the "open" menu.

=================================================================
==324091==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d00043efe8 at pc 0x000002431f32 bp 0x7ffe08af3620 sp 0x7ffe08af3618
READ of size 2 at 0x60d00043efe8 thread T0
    - 0 0x2431f31 in wm_handlers_do /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:3172
    - 1 0x2437321 in wm_event_do_handlers /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:3658
    - 2 0x23fded6 in WM_main /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:647
    - 3 0x121f704 in main /home/hans/Blender-Git/blender/source/creator/creator.c:558
    - 4 0x7f59a89bfb74 in __libc_start_main (/lib64/libc.so.6+0x27b74)
    - 5 0x121eb0d in _start (/home/hans/Blender-Git/build_linux_debug_lite/bin/blender+0x121eb0d)

0x60d00043efe8 is located 24 bytes inside of 136-byte region [0x60d00043efd0,0x60d00043f058)
freed by thread T0 here:
    - 0 0x7f59a8f6d647 in free (/lib64/libasan.so.6+0xae647)
    - 1 0x8eb186b in MEM_lockfree_freeN /home/hans/Blender-Git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:130
    - 2 0x241260e in wm_event_free /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:204
    - 3 0x24126c6 in wm_event_free_all /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:219
    - 4 0x2510e26 in wm_window_free /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_window.c:240
    - 5 0x23fd83b in wm_close_and_free /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:585
    - 6 0x23fdd85 in wm_close_and_free_all /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:627
    - 7 0x245311c in wm_window_match_replace_by_file_wm /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:385
    - 8 0x2453578 in wm_window_match_do /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:427
    - 9 0x2457c0f in WM_file_read /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:963
    - 10 0x24637ea in wm_file_read_opwrap /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2541
    - 11 0x24647e6 in wm_open_mainfile__open /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2663
    - 12 0x2463b63 in operator_state_dispatch /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2577
    - 13 0x2464a4f in wm_open_mainfile_dispatch /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2687
    - 14 0x2463e1d in wm_open_mainfile__discard_changes /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2616
    - 15 0x2463b63 in operator_state_dispatch /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2577
    - 16 0x2464a4f in wm_open_mainfile_dispatch /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2687
    - 17 0x2464a78 in wm_open_mainfile_invoke /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2692
    - 18 0x241e78a in wm_operator_invoke /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:1351
    - 19 0x24208f5 in wm_operator_call_internal /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:1592
    - 20 0x24209f9 in WM_operator_name_call_ptr /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:1606
    - 21 0x2421e6c in WM_operator_name_call_ptr_with_depends_on_cursor /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:1788
    - 22 0x654f885 in ui_apply_but_funcs_after /home/hans/Blender-Git/blender/source/blender/editors/interface/interface_handlers.c:1033
    - 23 0x65e49b0 in ui_popup_handler /home/hans/Blender-Git/blender/source/blender/editors/interface/interface_handlers.c:11539
    - 24 0x2417bf7 in wm_handler_ui_call /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:694
    - 25 0x2430b50 in wm_handlers_do_intern /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:3048
    - 26 0x2431ead in wm_handlers_do /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:3166
    - 27 0x2437321 in wm_event_do_handlers /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:3658
    - 28 0x23fded6 in WM_main /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:647
    - 29 0x121f704 in main /home/hans/Blender-Git/blender/source/creator/creator.c:558

previously allocated by thread T0 here:
    - 0 0x7f59a8f6d93f in __interceptor_malloc (/lib64/libasan.so.6+0xae93f)
    - 1 0x8eb22d5 in MEM_lockfree_mallocN /home/hans/Blender-Git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:277
    - 2 0x241069a in wm_event_add_ex /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:125
    - 3 0x2410971 in wm_event_add /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:142
    - 4 0x2447381 in wm_event_add_ghostevent /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:4960
    - 5 0x251da40 in ghost_event_proc /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_window.c:1484
    - 6 0x77bf5b5 in GHOST_CallbackEventConsumer::processEvent(GHOST_IEvent*) /home/hans/Blender-Git/blender/intern/ghost/intern/GHOST_CallbackEventConsumer.cpp:41
    - 7 0x786fca4 in GHOST_EventManager::dispatchEvent(GHOST_IEvent*) /home/hans/Blender-Git/blender/intern/ghost/intern/GHOST_EventManager.cpp:84
    - 8 0x787000e in GHOST_EventManager::dispatchEvent() /home/hans/Blender-Git/blender/intern/ghost/intern/GHOST_EventManager.cpp:94
    - 9 0x7870087 in GHOST_EventManager::dispatchEvents() /home/hans/Blender-Git/blender/intern/ghost/intern/GHOST_EventManager.cpp:100
    - 10 0x783b72d in GHOST_System::dispatchEvents() /home/hans/Blender-Git/blender/intern/ghost/intern/GHOST_System.cpp:218
    - 11 0x77b50d8 in GHOST_DispatchEvents /home/hans/Blender-Git/blender/intern/ghost/intern/GHOST_C-api.cpp:263
    - 12 0x251ea42 in wm_window_process_events /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_window.c:1558
    - 13 0x23fdeca in WM_main /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:644
    - 14 0x121f704 in main /home/hans/Blender-Git/blender/source/creator/creator.c:558
    - 15 0x7f59a89bfb74 in __libc_start_main (/lib64/libc.so.6+0x27b74)

SUMMARY: AddressSanitizer: heap-use-after-free /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:3172 in wm_handlers_do

**System Information** Operating system: Linux-5.14.11-200.fc34.x86_64-x86_64-with-glibc2.33 64 Bits Graphics card: NVIDIA GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 470.74 **Blender Version** Broken: version: 3.0.0 Alpha, branch: Unknown, commit date: Unknown Unknown, hash: `rBUnknown` Worked: Caused by 6e4ab5b761 **Exact steps for others to reproduce the error** - Start Blender with factory startup - Click on any file from the recent file list in the splash screen, or "Recent Files" in the file menu, or the "open" menu. ```lines=15 ================================================================= ==324091==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d00043efe8 at pc 0x000002431f32 bp 0x7ffe08af3620 sp 0x7ffe08af3618 READ of size 2 at 0x60d00043efe8 thread T0 - 0 0x2431f31 in wm_handlers_do /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:3172 - 1 0x2437321 in wm_event_do_handlers /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:3658 - 2 0x23fded6 in WM_main /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:647 - 3 0x121f704 in main /home/hans/Blender-Git/blender/source/creator/creator.c:558 - 4 0x7f59a89bfb74 in __libc_start_main (/lib64/libc.so.6+0x27b74) - 5 0x121eb0d in _start (/home/hans/Blender-Git/build_linux_debug_lite/bin/blender+0x121eb0d) 0x60d00043efe8 is located 24 bytes inside of 136-byte region [0x60d00043efd0,0x60d00043f058) freed by thread T0 here: - 0 0x7f59a8f6d647 in free (/lib64/libasan.so.6+0xae647) - 1 0x8eb186b in MEM_lockfree_freeN /home/hans/Blender-Git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:130 - 2 0x241260e in wm_event_free /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:204 - 3 0x24126c6 in wm_event_free_all /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:219 - 4 0x2510e26 in wm_window_free /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_window.c:240 - 5 0x23fd83b in wm_close_and_free /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:585 - 6 0x23fdd85 in wm_close_and_free_all /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:627 - 7 0x245311c in wm_window_match_replace_by_file_wm /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:385 - 8 0x2453578 in wm_window_match_do /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:427 - 9 0x2457c0f in WM_file_read /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:963 - 10 0x24637ea in wm_file_read_opwrap /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2541 - 11 0x24647e6 in wm_open_mainfile__open /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2663 - 12 0x2463b63 in operator_state_dispatch /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2577 - 13 0x2464a4f in wm_open_mainfile_dispatch /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2687 - 14 0x2463e1d in wm_open_mainfile__discard_changes /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2616 - 15 0x2463b63 in operator_state_dispatch /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2577 - 16 0x2464a4f in wm_open_mainfile_dispatch /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2687 - 17 0x2464a78 in wm_open_mainfile_invoke /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_files.c:2692 - 18 0x241e78a in wm_operator_invoke /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:1351 - 19 0x24208f5 in wm_operator_call_internal /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:1592 - 20 0x24209f9 in WM_operator_name_call_ptr /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:1606 - 21 0x2421e6c in WM_operator_name_call_ptr_with_depends_on_cursor /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:1788 - 22 0x654f885 in ui_apply_but_funcs_after /home/hans/Blender-Git/blender/source/blender/editors/interface/interface_handlers.c:1033 - 23 0x65e49b0 in ui_popup_handler /home/hans/Blender-Git/blender/source/blender/editors/interface/interface_handlers.c:11539 - 24 0x2417bf7 in wm_handler_ui_call /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:694 - 25 0x2430b50 in wm_handlers_do_intern /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:3048 - 26 0x2431ead in wm_handlers_do /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:3166 - 27 0x2437321 in wm_event_do_handlers /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:3658 - 28 0x23fded6 in WM_main /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:647 - 29 0x121f704 in main /home/hans/Blender-Git/blender/source/creator/creator.c:558 previously allocated by thread T0 here: - 0 0x7f59a8f6d93f in __interceptor_malloc (/lib64/libasan.so.6+0xae93f) - 1 0x8eb22d5 in MEM_lockfree_mallocN /home/hans/Blender-Git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:277 - 2 0x241069a in wm_event_add_ex /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:125 - 3 0x2410971 in wm_event_add /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:142 - 4 0x2447381 in wm_event_add_ghostevent /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:4960 - 5 0x251da40 in ghost_event_proc /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_window.c:1484 - 6 0x77bf5b5 in GHOST_CallbackEventConsumer::processEvent(GHOST_IEvent*) /home/hans/Blender-Git/blender/intern/ghost/intern/GHOST_CallbackEventConsumer.cpp:41 - 7 0x786fca4 in GHOST_EventManager::dispatchEvent(GHOST_IEvent*) /home/hans/Blender-Git/blender/intern/ghost/intern/GHOST_EventManager.cpp:84 - 8 0x787000e in GHOST_EventManager::dispatchEvent() /home/hans/Blender-Git/blender/intern/ghost/intern/GHOST_EventManager.cpp:94 - 9 0x7870087 in GHOST_EventManager::dispatchEvents() /home/hans/Blender-Git/blender/intern/ghost/intern/GHOST_EventManager.cpp:100 - 10 0x783b72d in GHOST_System::dispatchEvents() /home/hans/Blender-Git/blender/intern/ghost/intern/GHOST_System.cpp:218 - 11 0x77b50d8 in GHOST_DispatchEvents /home/hans/Blender-Git/blender/intern/ghost/intern/GHOST_C-api.cpp:263 - 12 0x251ea42 in wm_window_process_events /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_window.c:1558 - 13 0x23fdeca in WM_main /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:644 - 14 0x121f704 in main /home/hans/Blender-Git/blender/source/creator/creator.c:558 - 15 0x7f59a89bfb74 in __libc_start_main (/lib64/libc.so.6+0x27b74) SUMMARY: AddressSanitizer: heap-use-after-free /home/hans/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:3172 in wm_handlers_do ```

Hans Goudey commented

2021-10-15 23:54:47 +02:00

Added subscriber: @HooglyBoogly