search

mgerhardy / caveexpress

CaveExpress is a classic 2D platformer with physics-based gameplay and dozens of levels. CavePacker is a Sokoban game.
http://www.caveproductions.org/
Other
144 stars 20 forks source link

COMMON: AddressSanitizer: heap-use-after-free in Network.cpp:406 #37

Closed mgerhardy closed 9 years ago

mgerhardy commented 9 years ago

{code}

==12075==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040000aa5e0 at pc 0x7256d2 bp 0x7ffe62ed4350 sp 0x7ffe62ed4340 READ of size 4 at 0x6040000aa5e0 thread T0

0 0x7256d1 in Network::sendUDP(UDPsocket, IPaddress const&, IProtocolMessage const&) /home/mgerhardy/dev/caveexpress/src/modules/network/Network.cpp:407

#1 0x723b13 in Network::update(unsigned int) /home/mgerhardy/dev/caveexpress/src/modules/network/Network.cpp:234
#2 0x62db6c in SDLBackend::runFrame() /home/mgerhardy/dev/caveexpress/src/modules/server/SDLBackend.cpp:317
#3 0x62e37c in SDLBackend::mainLoop(int, char_*) /home/mgerhardy/dev/caveexpress/src/modules/server/SDLBackend.cpp:362
#4 0x5d68a5 in main /home/mgerhardy/dev/caveexpress/src/Main.cpp:28
#5 0x7fc8fed4da3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
#6 0x590568 in _start (/home/mgerhardy/dev/caveexpress/cavepacker+0x590568)

0x6040000aa5e0 is located 16 bytes inside of 40-byte region [0x6040000aa5d0,0x6040000aa5f8) freed by thread T0 here:

0 0x7fc900fa35af in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x575af)

#1 0x72564a in Network::sendUDP(_UDPsocket_, IPaddress const&, IProtocolMessage const&) /home/mgerhardy/dev/caveexpress/src/modules/network/Network.cpp:406
#2 0x723b13 in Network::update(unsigned int) /home/mgerhardy/dev/caveexpress/src/modules/network/Network.cpp:234
#3 0x62db6c in SDLBackend::runFrame() /home/mgerhardy/dev/caveexpress/src/modules/server/SDLBackend.cpp:317
#4 0x62e37c in SDLBackend::mainLoop(int, char_*) /home/mgerhardy/dev/caveexpress/src/modules/server/SDLBackend.cpp:362
#5 0x5d68a5 in main /home/mgerhardy/dev/caveexpress/src/Main.cpp:28
#6 0x7fc8fed4da3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)

previously allocated by thread T0 here:

0 0x7fc900fa3827 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x57827)

#1 0x7fc9005790c1 in SDLNet_AllocPacket (/usr/lib/x86_64-linux-gnu/libSDL2_net-2.0.so.0+0x20c1)

SUMMARY: AddressSanitizer: heap-use-after-free /home/mgerhardy/dev/caveexpress/src/modules/network/Network.cpp:407 Network::sendUDP(_UDPsocket*, IPaddress const&, IProtocolMessage const&) Shadow bytes around the buggy address: 0x0c088000d460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c088000d470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c088000d480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c088000d490: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c088000d4a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c088000d4b0: fa fa fa fa fa fa fa fa fa fa fd fd[fd]fd fd fa 0x0c088000d4c0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 00 0x0c088000d4d0: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 04 0x0c088000d4e0: fa fa 00 00 00 00 00 04 fa fa 00 00 00 00 07 fa 0x0c088000d4f0: fa fa 00 00 00 00 00 04 fa fa 00 00 00 00 00 06 0x0c088000d500: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 07 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==12075==ABORTING {code}