Crash when trying to frame a big object in ortho view (global-buffer-overflow with imperial Unit System) #107274

New Issue

Closed

opened 2023-04-23 22:11:59 +02:00 by Damien Picard · 8 comments

Damien Picard commented

2023-04-23 22:11:59 +02:00

Member

System Information
Operating system: Linux-6.2.0-20-generic-x86_64-with-glibc2.37 64 Bits, X11 UI
Graphics card: NVIDIA GeForce RTX 3060 Laptop GPU/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 515.105.01

Blender Version
Broken: version: 3.6.0 Alpha, branch: main, commit date: 2023-04-23 12:22, hash: 2ed6f738dae1
Worked: version: 2.81 (sub 16), branch: master, commit date: 2019-12-04 11:32, hash: rBf1aa4d18d49d

Short description of error
In a particular scene with a big text object generated with Geometry Nodes, Blender crashes when trying to use the Frame Selected operator (numpad .).
It only seems to happen in orthographic view.
I discovered this crash working on !106660.

Exact steps for others to reproduce the error

Open the attached bug_frame_selected_ortho_huge.blend file
In the 3D view, press "numpad ."
- Blender crashes.

The same happens if the GN modifier is applied.

**System Information** Operating system: Linux-6.2.0-20-generic-x86_64-with-glibc2.37 64 Bits, X11 UI Graphics card: NVIDIA GeForce RTX 3060 Laptop GPU/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 515.105.01 **Blender Version** Broken: version: 3.6.0 Alpha, branch: main, commit date: 2023-04-23 12:22, hash: `2ed6f738dae1` Worked: version: 2.81 (sub 16), branch: master, commit date: 2019-12-04 11:32, hash: `rBf1aa4d18d49d` **Short description of error** In a particular scene with a big text object generated with Geometry Nodes, Blender crashes when trying to use the Frame Selected operator (numpad .). It only seems to happen in orthographic view. I discovered this crash working on !106660. **Exact steps for others to reproduce the error** - Open the attached bug_frame_selected_ortho_huge.blend file - In the 3D view, press "numpad ." - Blender crashes. The same happens if the GN modifier is applied.

bug_frame_selected_ortho_huge.blend

94 KiB

156 KiB

Damien Picard added the

labels 2023-04-23 22:12:00 +02:00

Iliya Katushenock commented

2023-04-23 22:20:32 +02:00

Member

Most likely overflow/divide by zero. At me even debugging does not fall, depends on a platform.
Also: how you was connectied a string node 2 times with one multi-input? It's strange that it works without problems...

Most likely overflow/divide by zero. At me even debugging does not fall, depends on a platform. Also: how you was connectied a string node 2 times with one multi-input? It's strange that it works without problems...

Iliya Katushenock added the

label 2023-04-23 22:20:40 +02:00

Damien Picard commented

2023-04-23 22:29:35 +02:00

Author

Member

you was connectied a string node 2 times with one multi-input? It's strange that it works without problems...

I use the Lazy Connect with Menu operator from node wrangler. I was surprised to see it work too.
But the same crash also happens if I use reroutes instead, or multiple string input nodes.

> you was connectied a string node 2 times with one multi-input? It's strange that it works without problems... I use the Lazy Connect with Menu operator from node wrangler. I was surprised to see it work too. But the same crash also happens if I use reroutes instead, or multiple string input nodes.

Iliya Katushenock commented

2023-04-23 22:31:04 +02:00

Member

Yes, it's not related, it just surprised me.

Yes, it's not related, it just surprised me.

Pratik Borhade commented

2023-04-24 13:19:22 +02:00

Member

Hi, unable to confirm on Windows (tested on current master). @lichtwerk , can you reproduce the crash?

Hi, unable to confirm on Windows (tested on current master). @lichtwerk , can you reproduce the crash?

Philipp Oeser commented

2023-04-24 14:24:15 +02:00

Member

Yeah, can confirm, will check

Yeah, can confirm, will check

Philipp Oeser added

and removed

labels 2023-04-24 14:24:33 +02:00

Philipp Oeser commented

2023-04-24 14:59:52 +02:00

Member

Seems to only be the case with the imperial Unit System, getting a buffer overflow then :

==3069484==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000346d5e38 at pc 0x000001890d4f bp 0x7fff6e4a31b0 sp 0x7fff6e4a31a8
READ of size 8 at 0x0000346d5e38 thread T0
    #0 0x1890d4e in BKE_unit_display_name_get /blender/source/blender/blenkernel/intern/unit.c:1276
    #1 0xb820249 in ED_view3d_grid_view_scale /blender/source/blender/editors/space_view3d/view3d_draw.cc:931
    #2 0xb82674f in draw_grid_unit_name /blender/source/blender/editors/space_view3d/view3d_draw.cc:1436
    #3 0xb827aa0 in view3d_draw_region_info /blender/source/blender/editors/space_view3d/view3d_draw.cc:1517
    #4 0x4cd68e3 in DRW_draw_region_info /blender/source/blender/draw/intern/draw_view.c:45
    #5 0x4c12914 in DRW_draw_callbacks_post_scene /blender/source/blender/draw/intern/draw_manager.c:1525
    #6 0x4c14bc4 in DRW_draw_render_loop_ex /blender/source/blender/draw/intern/draw_manager.c:1771
    #7 0x4c136fb in DRW_draw_view /blender/source/blender/draw/intern/draw_manager.c:1632
    #8 0xb827f59 in view3d_draw_view /blender/source/blender/editors/space_view3d/view3d_draw.cc:1551
    #9 0xb8282d7 in view3d_main_region_draw /blender/source/blender/editors/space_view3d/view3d_draw.cc:1585
    #10 0x68641d8 in ED_region_do_draw /blender/source/blender/editors/screen/area.cc:536
    #11 0x3dcd8df in wm_draw_window_offscreen /blender/source/blender/windowmanager/intern/wm_draw.c:963
    #12 0x3dcef94 in wm_draw_window /blender/source/blender/windowmanager/intern/wm_draw.c:1128
    #13 0x3dd1f61 in wm_draw_update /blender/source/blender/windowmanager/intern/wm_draw.c:1512
    #14 0x3db7026 in WM_main /blender/source/blender/windowmanager/intern/wm.c:652
    #15 0x943006 in main /blender/source/creator/creator.c:583
    #16 0x7f61dd44a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f)
    #17 0x7f61dd44a5c8 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x275c8)
    #18 0x9421e4 in _start (/build_linux_debug/bin/blender+0x9421e4)

0x0000346d5e38 is located 16 bytes to the right of global variable 'buMetricLenDef' defined in '/blender/source/blender/blenkernel/intern/unit.c:130:24' (0x346d5ba0) of size 648
0x0000346d5e38 is located 40 bytes to the left of global variable 'buImperialLenDef' defined in '/blender/source/blender/blenkernel/intern/unit.c:150:24' (0x346d5e60) of size 576
SUMMARY: AddressSanitizer: global-buffer-overflow /blender/source/blender/blenkernel/intern/unit.c:1276 in BKE_unit_display_name_get
Shadow bytes around the buggy address:
  0x0000868d2b70: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000868d2b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000868d2b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000868d2ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000868d2bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0000868d2bc0: 00 00 00 00 00 f9 f9[f9]f9 f9 f9 f9 00 00 00 00
  0x0000868d2bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000868d2be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000868d2bf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000868d2c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000868d2c10: 00 00 00 00 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3069484==ABORTING

Seems to only be the case with the imperial Unit System, getting a buffer overflow then : ``` ==3069484==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000346d5e38 at pc 0x000001890d4f bp 0x7fff6e4a31b0 sp 0x7fff6e4a31a8 READ of size 8 at 0x0000346d5e38 thread T0 #0 0x1890d4e in BKE_unit_display_name_get /blender/source/blender/blenkernel/intern/unit.c:1276 #1 0xb820249 in ED_view3d_grid_view_scale /blender/source/blender/editors/space_view3d/view3d_draw.cc:931 #2 0xb82674f in draw_grid_unit_name /blender/source/blender/editors/space_view3d/view3d_draw.cc:1436 #3 0xb827aa0 in view3d_draw_region_info /blender/source/blender/editors/space_view3d/view3d_draw.cc:1517 #4 0x4cd68e3 in DRW_draw_region_info /blender/source/blender/draw/intern/draw_view.c:45 #5 0x4c12914 in DRW_draw_callbacks_post_scene /blender/source/blender/draw/intern/draw_manager.c:1525 #6 0x4c14bc4 in DRW_draw_render_loop_ex /blender/source/blender/draw/intern/draw_manager.c:1771 #7 0x4c136fb in DRW_draw_view /blender/source/blender/draw/intern/draw_manager.c:1632 #8 0xb827f59 in view3d_draw_view /blender/source/blender/editors/space_view3d/view3d_draw.cc:1551 #9 0xb8282d7 in view3d_main_region_draw /blender/source/blender/editors/space_view3d/view3d_draw.cc:1585 #10 0x68641d8 in ED_region_do_draw /blender/source/blender/editors/screen/area.cc:536 #11 0x3dcd8df in wm_draw_window_offscreen /blender/source/blender/windowmanager/intern/wm_draw.c:963 #12 0x3dcef94 in wm_draw_window /blender/source/blender/windowmanager/intern/wm_draw.c:1128 #13 0x3dd1f61 in wm_draw_update /blender/source/blender/windowmanager/intern/wm_draw.c:1512 #14 0x3db7026 in WM_main /blender/source/blender/windowmanager/intern/wm.c:652 #15 0x943006 in main /blender/source/creator/creator.c:583 #16 0x7f61dd44a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f) #17 0x7f61dd44a5c8 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x275c8) #18 0x9421e4 in _start (/build_linux_debug/bin/blender+0x9421e4) 0x0000346d5e38 is located 16 bytes to the right of global variable 'buMetricLenDef' defined in '/blender/source/blender/blenkernel/intern/unit.c:130:24' (0x346d5ba0) of size 648 0x0000346d5e38 is located 40 bytes to the left of global variable 'buImperialLenDef' defined in '/blender/source/blender/blenkernel/intern/unit.c:150:24' (0x346d5e60) of size 576 SUMMARY: AddressSanitizer: global-buffer-overflow /blender/source/blender/blenkernel/intern/unit.c:1276 in BKE_unit_display_name_get Shadow bytes around the buggy address: 0x0000868d2b70: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x0000868d2b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000868d2b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000868d2ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000868d2bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0000868d2bc0: 00 00 00 00 00 f9 f9[f9]f9 f9 f9 f9 00 00 00 00 0x0000868d2bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000868d2be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000868d2bf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000868d2c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000868d2c10: 00 00 00 00 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3069484==ABORTING ```

Philipp Oeser changed title from ~~Crash when trying to frame a big object in ortho view~~ to Crash when trying to frame a big object in ortho view (global-buffer-overflow with imperial Unit System)

2023-04-24 15:00:19 +02:00

Damien Picard commented

2023-04-24 16:49:38 +02:00

Author

Member

In addition, it only happens when the Text Info overlay is enabled. I’d guess there’s a problem with the string for miles?

In addition, it only happens when the Text Info overlay is enabled. I’d guess there’s a problem with the string for miles?

Philipp Oeser commented

2023-04-27 15:07:19 +02:00

Member

@mano-wii : think this is related to 859f2561c8 or 4bf37bafc2
@ideasman42 : there was a similar fix already (07df76496d), mind checking also?

@mano-wii : think this is related to 859f2561c858e5a5d809e42eff73f960ed1036ee or 4bf37bafc270 @ideasman42 : there was a similar fix already (07df76496d23), mind checking also?

Philipp Oeser added

EEVEE & Viewport

and removed

labels 2023-04-27 15:08:05 +02:00

Campbell Barton referenced this issue from a commit

2023-04-27 15:50:51 +02:00

Fix #107274: Crash zooming out with imperial unit-system

Campbell Barton closed this issue

2023-04-27 15:50:53 +02:00

Blender Bot added

and removed

labels 2023-04-27 15:50:54 +02:00

Germano Cavalcante referenced this issue

2023-04-27 17:48:29 +02:00

Overlay: Do not draw grids with undefined units #107405

Sign in to join this conversation.

No Label

Animation & Rigging

Asset Browser Project Overview

Automated Testing

Blender Asset Bundle

Dependency Graph

Development Management

EEVEE & Viewport

Images & Movies

Motion Tracking

Nodes & Physics

Pipeline, Assets & IO

Platforms, Builds & Tests

Render & Cycles

Render Pipeline

Sculpt, Paint & Texture

Video Sequencer

Virtual Reality

Blender 2.8 Project

Milestone 1: Basic, Local Asset Browser

Good First Issue

Animation & Rigging

Development Management

EEVEE & Viewport

Nodes & Physics

Pipeline, Assets & IO

Platforms, Builds & Tests

Render & Cycles

Sculpt, Paint & Texture

Needs Info from Developers

Needs Information from User

No Milestone

No project

No Assignees

4 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: blender/blender#107274

No description provided.