Open mackal opened 1 year ago
Also have the same problem:
==108110==ERROR: AddressSanitizer: heap-use-after-free on address 0x503000028c30 at pc 0x5f9bc4fb45c0 bp 0x7ffdf0c89d90 sp 0x7ffdf0c89550
READ of size 1 at 0x503000028c30 thread T0
#0 0x5f9bc4fb45bf in strcmp.part.0 asan_interceptors.cpp.o
#1 0x72ad802b0d85 (/usr/lib/liblua.so.5.4+0x18d85) (BuildId: 840cd7592307bf9ff008351d1bcf370b6579562b)
#2 0x72ad802a8135 (/usr/lib/liblua.so.5.4+0x10135) (BuildId: 840cd7592307bf9ff008351d1bcf370b6579562b)
#3 0x5f9bc52c3ff8 in void sol::stack::field_setter<char const*, false, false, void>::set<char const*, sol::lua_nil_t const&>(lua_State*, char const*&&, sol::lua_nil_t const&, int) /usr/include/sol/stack_field.hpp:223:7
#4 0x5f9bc52c3ff8 in void sol::stack::set_field<false, false, char const*, sol::lua_nil_t const&>(lua_State*, char const*&&, sol::lua_nil_t const&, int) /usr/include/sol/stack_core.hpp:1250:59
#5 0x5f9bc52c3ff8 in void sol::u_detail::clear_usertype_registry_names<AuthProtocol>(lua_State*) /usr/include/sol/usertype_storage.hpp:821:3
#6 0x5f9bc52c41c5 in int sol::u_detail::destroy_usertype_storage<AuthProtocol>(lua_State*) /usr/include/sol/usertype_storage.hpp:831:3
#7 0x72ad802aa6da (/usr/lib/liblua.so.5.4+0x126da) (BuildId: 840cd7592307bf9ff008351d1bcf370b6579562b)
#8 0x72ad802ad1f5 (/usr/lib/liblua.so.5.4+0x151f5) (BuildId: 840cd7592307bf9ff008351d1bcf370b6579562b)
#9 0x72ad802a5573 (/usr/lib/liblua.so.5.4+0xd573) (BuildId: 840cd7592307bf9ff008351d1bcf370b6579562b)
#10 0x72ad802c4f33 (/usr/lib/liblua.so.5.4+0x2cf33) (BuildId: 840cd7592307bf9ff008351d1bcf370b6579562b)
#11 0x72ad802a1948 (/usr/lib/liblua.so.5.4+0x9948) (BuildId: 840cd7592307bf9ff008351d1bcf370b6579562b)
#12 0x72ad802a9327 (/usr/lib/liblua.so.5.4+0x11327) (BuildId: 840cd7592307bf9ff008351d1bcf370b6579562b)
#13 0x72ad802aea2e (/usr/lib/liblua.so.5.4+0x16a2e) (BuildId: 840cd7592307bf9ff008351d1bcf370b6579562b)
#14 0x5f9bc5305212 in sol::detail::state_deleter::operator()(lua_State*) const /usr/include/sol/raii.hpp:70:5
#15 0x5f9bc5305212 in std::unique_ptr<lua_State, sol::detail::state_deleter>::~unique_ptr() /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/unique_ptr.h:404:4
#16 0x5f9bc5305212 in sol::state::~state() /usr/include/sol/state.hpp:58:3
#17 0x72ad7fa5cb35 (/usr/lib/libc.so.6+0x3eb35) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af)
#18 0x72ad7fa5cc7f in exit (/usr/lib/libc.so.6+0x3ec7f) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af)
#19 0x72ad7fa43cd6 (/usr/lib/libc.so.6+0x25cd6) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af)
#20 0x72ad7fa43d89 in __libc_start_main (/usr/lib/libc.so.6+0x25d89) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af)
#21 0x5f9bc4eff124 in _start (/mnt/Dev/Projects/games/echoes/client/build/client+0x1de124) (BuildId: 00e57742313dd2cf1b1d889d0383cba0da3c8da9)
0x503000028c30 is located 0 bytes inside of 17-byte region [0x503000028c30,0x503000028c41)
freed by thread T0 here:
#0 0x5f9bc5036e1a in operator delete(void*) (/mnt/Dev/Projects/games/echoes/client/build/client+0x315e1a) (BuildId: 00e57742313dd2cf1b1d889d0383cba0da3c8da9)
#1 0x72ad7fa5cb35 (/usr/lib/libc.so.6+0x3eb35) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af)
previously allocated by thread T0 here:
#0 0x5f9bc5036382 in operator new(unsigned long) (/mnt/Dev/Projects/games/echoes/client/build/client+0x315382) (BuildId: 00e57742313dd2cf1b1d889d0383cba0da3c8da9)
#1 0x5f9bc503d87d in void std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::_M_construct<char*>(char*, char*, std::forward_iterator_tag) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/13.2.1/../../../../include/c++/13.2.1/bits/basic_string.tcc:225:14
#2 0x5f9bc52c3c28 in sol::usertype_traits<AuthProtocol>::metatable[abi:cxx11]() /usr/include/sol/usertype_traits.hpp:42:33
#3 0x5f9bc52c24be in int sol::u_detail::register_usertype<AuthProtocol, (sol::automagic_flags)511>(lua_State*, sol::automagic_enrollments) /usr/include/sol/usertype_storage.hpp:1013:51
#4 0x5f9bc52c18a4 in sol::basic_usertype<AuthProtocol, sol::basic_reference<false>> sol::basic_table_core<true, sol::basic_reference<false>>::new_usertype<AuthProtocol, char const (&) [13], (sol::automagic_flags)511>(char const (&) [13], sol::constant_automagic_enrollments<(sol::automagic_flags)511>) /usr/include/sol/table.hpp:44:18
#5 0x5f9bc52058c5 in sol::basic_usertype<AuthProtocol, sol::basic_reference<false>> sol::basic_table_core<true, sol::basic_reference<false>>::new_usertype<AuthProtocol, char const (&) [13], sol::factory_wrapper<Script::registerFunctions()::$_3>, sol::base_list<> const&, sol::base_list<Protocol>, char const (&) [10], void (AuthProtocol::*)(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&), char const (&) [25], void (AuthProtocol::*)(), char const (&) [20], void (AuthProtocol::*)(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, unsigned char, bool, bool, bool), char const (&) [20], void (AuthProtocol::*)(unsigned long), char const (&) [8], std::function<void (bool, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&)> AuthProtocol::*, char const (&) [16], std::function<void (std::vector<CharacterListEntry, std::allocator<CharacterListEntry>> const&)> AuthProtocol::*, void>(char const (&) [13], sol::factory_wrapper<Script::registerFunctions()::$_3>&&, sol::base_list<> const&, sol::base_list<Protocol>&&, char const (&) [10], void (AuthProtocol::*&&)(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&), char const (&) [25], void (AuthProtocol::*&&)(), char const (&) [20], void (AuthProtocol::*&&)(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, unsigned char, bool, bool, bool), char const (&) [20], void (AuthProtocol::*&&)(unsigned long), char const (&) [8], std::function<void (bool, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&)> AuthProtocol::*&&, char const (&) [16], std::function<void (std::vector<CharacterListEntry, std::allocator<CharacterListEntry>> const&)> AuthProtocol::*&&) /usr/include/sol/table.hpp:70:30
#6 0x5f9bc52058c5 in sol::basic_usertype<AuthProtocol, sol::basic_reference<false>> sol::state_view::new_usertype<AuthProtocol, char const (&) [13], sol::factory_wrapper<Script::registerFunctions()::$_3>, sol::base_list<> const&, sol::base_list<Protocol>, char const (&) [10], void (AuthProtocol::*)(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&), char const (&) [25], void (AuthProtocol::*)(), char const (&) [20], void (AuthProtocol::*)(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, unsigned char, bool, bool, bool), char const (&) [20], void (AuthProtocol::*)(unsigned long), char const (&) [8], std::function<void (bool, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&)> AuthProtocol::*, char const (&) [16], std::function<void (std::vector<CharacterListEntry, std::allocator<CharacterListEntry>> const&)> AuthProtocol::*>(char const (&) [13], sol::factory_wrapper<Script::registerFunctions()::$_3>&&, sol::base_list<> const&, sol::base_list<Protocol>&&, char const (&) [10], void (AuthProtocol::*&&)(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&), char const (&) [25], void (AuthProtocol::*&&)(), char const (&) [20], void (AuthProtocol::*&&)(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, unsigned char, bool, bool, bool), char const (&) [20], void (AuthProtocol::*&&)(unsigned long), char const (&) [8], std::function<void (bool, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&)> AuthProtocol::*&&, char const (&) [16], std::function<void (std::vector<CharacterListEntry, std::allocator<CharacterListEntry>> const&)> AuthProtocol::*&&) /usr/include/sol/state_view.hpp:785:18
#7 0x5f9bc52058c5 in Script::registerFunctions() /mnt/Dev/Projects/games/echoes/client/src/script.cpp:129:8
#8 0x5f9bc515c097 in Script::init() /mnt/Dev/Projects/games/echoes/shared/src/script/script.cpp:74:2
#9 0x5f9bc52fd608 in Window::run(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>> const&) /mnt/Dev/Projects/games/echoes/client/src/engine/window.cpp:40:21
#10 0x5f9bc51fd5ea in main /mnt/Dev/Projects/games/echoes/client/src/main.cpp:9:28
#11 0x72ad7fa43ccf (/usr/lib/libc.so.6+0x25ccf) (BuildId: c0caa0b7709d3369ee575fcd7d7d0b0fc48733af)
SUMMARY: AddressSanitizer: heap-use-after-free asan_interceptors.cpp.o in strcmp.part.0
Shadow bytes around the buggy address:
0x503000028980: fa fa 00 00 00 04 fa fa fd fd fd fd fa fa fd fd
0x503000028a00: fd fa fa fa 00 00 00 fa fa fa fd fd fd fa fa fa
0x503000028a80: fd fd fd fd fa fa fd fd fd fa fa fa fd fd fd fd
0x503000028b00: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
0x503000028b80: fd fa fa fa fd fd fd fd fa fa fd fd fd fd fa fa
=>0x503000028c00: fd fd fd fd fa fa[fd]fd fd fa fa fa 00 00 00 fa
0x503000028c80: fa fa fd fd fd fa fa fa fd fd fd fd fa fa fd fd
0x503000028d00: fd fa fa fa 00 00 00 fa fa fa fd fd fd fd fa fa
0x503000028d80: 00 00 00 fa fa fa fd fd fd fd fa fa 00 00 00 fa
0x503000028e00: fa fa fd fd fd fd fa fa fd fd fd fa fa fa 00 00
0x503000028e80: 00 fa fa fa 00 00 03 fa fa fa fd fd fd fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==108110==ABORTING
In porting a project to sol2 we have a LuaParser class that uses singleton pattern for now. ASan doesn't report problems when it's just tables, enums, etc, just happens once I add a usertype.
This happened on my local machine using GCC 12 and my test debian VM using GCC 10. Clang 14 on my local machine also has the same issue. Tried with lua 5.4, 5.1, and LuaJIT 2.1.0_beta3_p20220613 (whatever that is on Gentoo). Sol version was 3.3.0 and tried current develop HEAD
Here is a repo:
ASan output: