Closed nekonomicon closed 7 years ago
Yet UB:
/usr/ports/games/xash3d/work/xash3d-90b8efd/engine/common/imagelib/img_utils.c:467:27: runtime error: division by zero
/usr/ports/games/xash3d/work/xash3d-90b8efd/engine/client/s_dsp.c:197:24: runtime error: signed integer overflow: -3301 * -651222 cannot be represented in type 'int'
/usr/ports/games/xash3d/work/xash3d-90b8efd/engine/server/sv_world.c:1251:11: runtime error: member access within null pointer of type 'edict_t' (aka 'struct edict_s')
/usr/ports/games/xash3d/work/xash3d-90b8efd/engine/common/net_chan.c:1278:51: runtime error: member access within misaligned address 0x30706942 for type 'fragbuf_t' (aka 'struct fragbuf_s'), which requires 4 byte alignment
0x30706942: note: pointer points here
<memory cannot be printed>
/usr/ports/games/xash3d/work/xash3d-90b8efd/engine/common/net_buffer.h:94:74: runtime error: member access within misaligned address 0x3070694a for type 'sizebuf_t' (aka 'struct sizebuf_s'), which requires 4 byte alignment
0x3070694a: note: pointer points here
<memory cannot be printed>
/usr/ports/games/xash3d/work/xash3d-90b8efd/engine/common/net_chan.c:1437:15: runtime error: division by zero
/usr/ports/games/xash3d/work/xash3d-90b8efd/engine/common/net_chan.c:461:10: runtime error: signed integer overflow: 2139127679 + 1098907648 cannot be represented in type 'int'
/usr/ports/games/xash3d/work/xash3d-90b8efd/engine/common/zone.c:180:11: runtime error: member access within misaligned address 0x7f7f7f5f for type 'memheader_t' (aka 'struct memheader_s'), which requires 4 byte alignment
0x7f7f7f5f: note: pointer points here
<memory cannot be printed>
it seems that zone allocator allocates unaligned memory blocks
Hello again! I tried build branch msvc6 with optlevel -O2:
Program received signal SIGSEGV, Segmentation fault.
0x28ae7c4e in pfnSPR_LoadExt () from /compat/i386/usr/local/lib/xash3d/libxash.so
(gdb) bt
#0 0x28ae7c4e in pfnSPR_LoadExt () from /compat/i386/usr/local/lib/xash3d/libxash.so
#1 0x28ae7e86 in pfnSPR_Load () from /compat/i386/usr/local/lib/xash3d/libxash.so
#2 0x28aae488 in SCR_RegisterTextures () from /compat/i386/usr/local/lib/xash3d/libxash.so
#3 0x28aaec11 in SCR_Init () from /compat/i386/usr/local/lib/xash3d/libxash.so
#4 0x28a80c2f in R_Init () from /compat/i386/usr/local/lib/xash3d/libxash.so
#5 0x289f3594 in CL_Init () from /compat/i386/usr/local/lib/xash3d/libxash.so
#6 0x28bb8ebc in Host_Main () from /compat/i386/usr/local/lib/xash3d/libxash.so
#7 0x0806749b in main ()
(gdb) c
Continuing.
Sys_Crash: signal 11, err 0 with code 1 at 0x1de88
Stack backtrace:
1: 0x28ae7c4e <pfnSPR_LoadExt+558> (/compat/i386/usr/local/lib/xash3d/libxash.so)
2: 0x28ae7e86 <pfnSPR_Load+38> (/compat/i386/usr/local/lib/xash3d/libxash.so)
3: 0x28aae488 <SCR_RegisterTextures+424> (/compat/i386/usr/local/lib/xash3d/libxash.so)
4: 0x28aaec11 <SCR_Init+721> (/compat/i386/usr/local/lib/xash3d/libxash.so)
5: 0x28a80c2f <R_Init+1343> (/compat/i386/usr/local/lib/xash3d/libxash.so)
6: 0x289f3594 <CL_Init+52> (/compat/i386/usr/local/lib/xash3d/libxash.so)
7: 0x28bb8ebc <Host_Main+1244> (/compat/i386/usr/local/lib/xash3d/libxash.so)
8: 0x806749b <main+91> (/compat/i386/usr/local/bin/xash3d-bin)
9: 0x804a09a <_start+346> (/compat/i386/usr/local/bin/xash3d-bin)
10: 0x8049f58 <_start+24> (/compat/i386/usr/local/bin/xash3d-bin)
Stack dump:
0: 0x0
1: 0x0
2: 0x1869f
3: 0x28e31c38 <psettemplates+221364> (/compat/i386/usr/local/lib/xash3d/libxash.so)
4: 0x188
5: 0x28333dc4 <__stack_chk_guard+0> (/usr/lib32/libc.so.7)
6: a(����P(X���p(
����� ����������
/usr/ports/games/xash3d/work/xash3d-fd65658/engine/common/sys_win.c:562:35: runtime error: index 1092 out of bounds for type 'char [1024]'
/usr/ports/games/xash3d/work/xash3d-fd65658/engine/common/sys_win.c:563:22: runtime error: index 1092 out of bounds for type 'char [1024]'
/usr/ports/games/xash3d/work/xash3d-fd65658/engine/common/sys_win.c:564:26: runtime error: index 1092 out of bounds for type 'char [1024]'
[21:49:48] Sys_Crash: signal 11, err 0 with code 1 at 0x1de88
Stack backtrace:
1: 0x28ae7c4e pfnSPR_LoadExt+558 (/compat/i386/usr/local/lib/xash3d/libxash.so)
2: 0x28ae7e86 pfnSPR_Load+38 (/compat/i386/usr/local/lib/xash3d/libxash.so)
3: 0x28aae488 SCR_RegisterTextures+424 (/compat/i386/usr/local/lib/xash3d/libxash.so)
4: 0x28aaec11 SCR_Init+721 (/compat/i386/usr/local/lib/xash3d/libxash.so)
5: 0x28a80c2f R_Init+1343 (/compat/i386/usr/local/lib/xash3d/libxash.so)
6: 0x289f3594 CL_Init+52 (/compat/i386/usr/local/lib/xash3d/libxash.so)
7: 0x28bb8ebc Host_Main+1244 (/compat/i386/usr/local/lib/xash3d/libxash.so)
8: 0x806749b main+91 (/compat/i386/usr/local/bin/xash3d-bin)
9: 0x804a09a _start+346 (/compat/i386/usr/local/bin/xash3d-bin)
10: 0x8049f58 _start+24 (/compat/i386/usr/local/bin/xash3d-bin)
Stack dump:
0: 0x0
1: 0x0
2: 0x1869f
3: 0x28e31c38 psettemplates+221364 (/compat/i386/usr/local/lib/xash3d/libxash.so)
4: 0x188
5: 0x28333dc4 __stack_chk_guard+0 (/usr/lib32/libc.so.7)
6:
(build 3153) crashed at Dec09 2015 [21:49.55]
(build 3153) stopped at Dec09 2015 [21:49.55]
Inferior 1 (process 87699) exited with code 01 (gdb)
Can you enable dwarf debug data when compiling?-g or -ggdb option
I can reproduce now:
/usr/ports/games/xash3d/work/xash3d-831cbed/engine/client/s_dsp.c:197:24: runtime error: signed integer overflow: -3301 * -656832 cannot be represented in type 'int'
/usr/ports/games/xash3d/work/xash3d-831cbed/engine/client/gl_rsurf.c:1204:8: runtime error: index 4 out of bounds for type 'byte [4]'
/usr/ports/games/xash3d/work/xash3d-72904b7/loader/pe_image.c:493:5: runtime error: store to misaligned address 0x2f15001f for type 'int', which requires 4 byte alignment
/usr/ports/games/xash3d/work/xash3d-72904b7/engine/client/gl_rlight.c:349:40: runtime error: value 369 is outside the range of representable values of type 'unsigned char'
/usr/ports/games/xash3d/work/xash3d-72904b7/engine/client/gl_rlight.c:350:40: runtime error: value 369 is outside the range of representable values of type 'unsigned char'
/usr/ports/games/xash3d/work/xash3d-72904b7/engine/client/gl_rlight.c:351:40: runtime error: value 289 is outside the range of representable values of type 'unsigned char'
/usr/ports/games/xash3d/work/xash3d-72904b7/engine/client/cl_game.c:3154:12: runtime error: value 298.354 is outside the range of representable values of type 'unsigned char'
/usr/ports/games/xash3d/work/xash3d-72904b7/engine/client/cl_game.c:3155:12: runtime error: value 298.354 is outside the range of representable values of type 'unsigned char'
/usr/ports/games/xash3d/work/xash3d-72904b7/engine/client/cl_game.c:3156:12: runtime error: value 298.354 is outside the range of representable values of type 'unsigned char'
hlwe only:
/usr/ports/games/xash3d/work/xash3d-72904b7/engine/server/sv_frame.c:519:20: runtime error: index 33 out of bounds for type 'weapon_data_t [32]'
/usr/ports/games/xash3d/work/xash3d-72904b7/engine/server/sv_frame.c:520:13: runtime error: index 33 out of bounds for type 'weapon_data_t [32]'
Warning:
/usr/ports/games/xash3d/work/xash3d-72904b7/engine/common/model.c:2800:90: warning: array index 16 is past the end of the array (which contains 15 elements) [-Warray-bounds]
Mod_LoadClipnodes31( &header->lumps[LUMP_CLIPNODES], &header->lumps[LUMP_CLIPNODES2], &header->lumps[LUMP_CLIPNODES3] );
^ ~~~~~~~~~~~~~~~
/usr/ports/games/xash3d/work/xash3d-72904b7/engine/../common/bspfile.h:152:2: note: array 'lumps' declared here
dlump_t lumps[HEADER_LUMPS];
^
Big Scientists( Spirit Of Half Life 1.2 ):
/usr/ports/games/xash3d/work/xash3d-1c4ba03/engine/common/net_buffer.c:272:6: runtime error: value nan is outside the range of representable values of type 'int'
CS 1.6(I can't reproduce it again.) :
Sys_Crash: signal 11, err 0 with code 1 at 0x6b
Stack backtrace:
1: 0x288529ab <CL_GetEntitySpatialization+347> (/compat/i386/usr/local/lib/xash3d/libxash.so)
2: 0x28869f71 <SND_Spatialize+145> (/compat/i386/usr/local/lib/xash3d/libxash.so)
3: 0x2886a4f1 <S_StartSound+753> (/compat/i386/usr/local/lib/xash3d/libxash.so)
4: 0x2884cb8c <CL_ParseSoundPacket+412> (/compat/i386/usr/local/lib/xash3d/libxash.so)
5: 0x2884f544 <CL_ParseServerMessage+580> (/compat/i386/usr/local/lib/xash3d/libxash.so)
6: 0x2888bb35 <CL_ReadNetMessage+437> (/compat/i386/usr/local/lib/xash3d/libxash.so)
7: 0x2888bdaa <CL_ReadPackets+26> (/compat/i386/usr/local/lib/xash3d/libxash.so)
8: 0x2888cec3 <Host_ClientFrame+211> (/compat/i386/usr/local/lib/xash3d/libxash.so)
9: 0x28939255 <Host_Frame+101> (/compat/i386/usr/local/lib/xash3d/libxash.so)
10: 0x2893a49d <Host_Main+2093> (/compat/i386/usr/local/lib/xash3d/libxash.so)
11: 0x8048a3b (/compat/i386/usr/local/bin/xash3d-bin)
12: 0x804872a (/compat/i386/usr/local/bin/xash3d-bin)Stack dump:
Singleplayer on amd64:
[21:19:37] server(ai): TRAIN(train): Speed is 0
[21:19:37] Game started
[21:19:38] SV_ConnectionlessPacket: loopback : connect
[21:19:38] SV_ClientConnect()
[21:19:38] CL_ConnectionlessPacket: loopback : client_connect
[21:19:38] Spooling demo header.
[21:19:39] ucmd->new()
[21:19:39] Serverdata packet received.
==9413== Invalid read of size 1
==9413== at 0x656AB82: Q_strnicmp (crtlib.c:353)
==9413== by 0x64A74B2: CL_TextMessageGet (cl_game.c:1669)
==9413== by 0x64E2F27: CL_ParseServerData (cl_parse.c:652)
==9413== by 0x64E52FD: CL_ParseServerMessage (cl_parse.c:1544)
==9413== by 0x646B993: CL_ReadNetMessage (cl_main.c:1471)
==9413== by 0x646BC3A: CL_ReadPackets (cl_main.c:1498)
==9413== by 0x646CBEB: Host_ClientFrame (cl_main.c:1795)
==9413== by 0x6570B2F: Host_Frame (host.c:617)
==9413== by 0x6572202: Host_Main (host.c:1121)
==9413== by 0x400D57: main (in /usr/local/bin/xash3d-bin)
==9413== Address 0x8060dcd20 is not stack'd, malloc'd or (recently) free'd
==9413==
==9413== Syscall param sigprocmask(set) points to uninitialised byte(s)
==9413== at 0x52043FA: _sigprocmask (in /lib/libc.so.7)
==9413== by 0x5B0ADB4: ??? (in /lib/libthr.so.3)
==9413== by 0x5B0A3AE: ??? (in /lib/libthr.so.3)
==9413== by 0x38074467: ??? (in /usr/local/lib/valgrind/memcheck-amd64-freebsd)
==9413== by 0x64A74B2: CL_TextMessageGet (cl_game.c:1669)
==9413== by 0x64E2F27: CL_ParseServerData (cl_parse.c:652)
==9413== by 0x64E52FD: CL_ParseServerMessage (cl_parse.c:1544)
==9413== by 0x646B993: CL_ReadNetMessage (cl_main.c:1471)
==9413== by 0x646BC3A: CL_ReadPackets (cl_main.c:1498)
==9413== by 0x646CBEB: Host_ClientFrame (cl_main.c:1795)
==9413== by 0x6570B2F: Host_Frame (host.c:617)
==9413== by 0x6572202: Host_Main (host.c:1121)
==9413== Address 0x7fefff3fc is on thread 1's stack
==9413== Uninitialised value was created by a stack allocation
==9413== at 0x644D87C: ??? (in /usr/local/lib/xash3d/libxash.so)
==9413==
Sys_Crash: signal 11, err 0 with code 1 at 0x8060dcd20
It seems, we found reason of broken lightmaps sometimes?
I think not actually now.
Build clang 3.7 on FreeBSD 11-current with flags -O0 -fsanitize=undefined: