ASAN failure when selecting text in Text Editor #96510

New Issue

Jesse Yurkovich · 2022-03-16T03:15:47+01:00

Jesse Yurkovich commented

2022-03-16 03:15:47 +01:00

System Information
Operating system: Windows-10-10.0.19044-SP0 64 Bits
Graphics card: AMD FirePro W2100 ATI Technologies Inc. 4.5.14831 Core Profile Context FireGL 21.Q2.1 27.20.21026.2006

Blender Version
Broken: version: 3.2.0 Alpha, branch: master, commit date: 2022-03-16 11:58:22, hash: be7855591e
Worked: n/a

Caused by 541ba68991

Short description of error
There's a buffer overrun on when selecting text inside the Text Editor.

Exact steps for others to reproduce the error

Open up Text Editor
Type "abcdef asdf"
Use your mouse to drag-select "abcdef" and release the button
Observe below error

The issue is that txt_sel_to_buf returns a buffer that is not null-terminated so the loop inside WM_clipboard_text_set walks off the end. That's for Windows at least. However, the GHOST_putClipboard api is probably similarly affected for all platforms.

=================================================================
==17480==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x11f3ea0052e0 at pc 0x7ff78b266add bp 0x007327ffe550 sp 0x007327ffe558
READ of size 1 at 0x11f3ea0052e0 thread T0
    - 0 0x7ff78b266adc in WM_clipboard_text_set E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_window.c:1732
    - 1 0x7ff78ed1c5c5 in text_cursor_set_exit E:\source\blender-git\blender\source\blender\editors\space_text\text_ops.c:3247
    - 2 0x7ff78ed1cdcf in text_selection_set_modal E:\source\blender-git\blender\source\blender\editors\space_text\text_ops.c:3289
    - 3 0x7ff78b2a2e73 in wm_handler_operator_call E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:2282
    - 4 0x7ff78b2a7e0e in wm_handlers_do_intern E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:3143
    - 5 0x7ff78b2a80f4 in wm_handlers_do E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:3195
    - 6 0x7ff78b2952f9 in wm_event_do_handlers E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:3763
    - 7 0x7ff78b24754d in WM_main E:\source\blender-git\blender\source\blender\windowmanager\intern\wm.c:623
    - 8 0x7ff789c5f29b in main E:\source\blender-git\blender\source\creator\creator.c:544
    - 9 0x7ff799ccbdc8 in invoke_main d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    - 10 0x7ff799ccbd1d in __scrt_common_main_seh d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    - 11 0x7ff799ccbbdd in __scrt_common_main d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:330
    - 12 0x7ff799ccbe3d in mainCRTStartup d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_main.cpp:16
    - 13 0x7ff8827a7033 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017033)
    #14 0x7ff8839a2650 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180052650)

0x11f3ea0052e0 is located 0 bytes to the right of 16-byte region [0x11f3ea0052d0,0x11f3ea0052e0)
allocated by thread T0 here:
    - 0 0x7fff8fa2f211 in _asan_wrap_GlobalSize+0x4c50b (E:\source\blender-git\build-full-asan\bin\Debug\clang_rt.asan_dbg_dynamic-x86_64.dll+0x18004f211)
    - 1 0x7ff799a6b769 in MEM_lockfree_mallocN E:\source\blender-git\blender\intern\guardedalloc\intern\mallocn_lockfree_impl.c:263
    - 2 0x7ff78a7a70c2 in txt_sel_to_buf E:\source\blender-git\blender\source\blender\blenkernel\intern\text.c:1503
    - 3 0x7ff78ed1c5b4 in text_cursor_set_exit E:\source\blender-git\blender\source\blender\editors\space_text\text_ops.c:3246
    - 4 0x7ff78ed1cdcf in text_selection_set_modal E:\source\blender-git\blender\source\blender\editors\space_text\text_ops.c:3289
    - 5 0x7ff78b2a2e73 in wm_handler_operator_call E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:2282
    - 6 0x7ff78b2a7e0e in wm_handlers_do_intern E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:3143
    - 7 0x7ff78b2a80f4 in wm_handlers_do E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:3195
    - 8 0x7ff78b2952f9 in wm_event_do_handlers E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:3763
    - 9 0x7ff78b24754d in WM_main E:\source\blender-git\blender\source\blender\windowmanager\intern\wm.c:623
    - 10 0x7ff789c5f29b in main E:\source\blender-git\blender\source\creator\creator.c:544
    - 11 0x7ff799ccbdc8 in invoke_main d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    - 12 0x7ff799ccbd1d in __scrt_common_main_seh d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    - 13 0x7ff799ccbbdd in __scrt_common_main d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:330
    - 14 0x7ff799ccbe3d in mainCRTStartup d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_main.cpp:16
    - 15 0x7ff8827a7033 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017033)
    #16 0x7ff8839a2650 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180052650)

SUMMARY: AddressSanitizer: heap-buffer-overflow E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_window.c:1732 in WM_clipboard_text_set
Shadow bytes around the buggy address:
  0x042e63c00a00: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x042e63c00a10: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x042e63c00a20: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x042e63c00a30: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x042e63c00a40: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
=>0x042e63c00a50: fa fa fd fd fa fa 00 00 fa fa 00 00[fa]fa fd fa
  0x042e63c00a60: fa fa fd fa fa fa 04 fa fa fa 04 fa fa fa 01 fa
  0x042e63c00a70: fa fa 01 fa fa fa 00 fa fa fa 01 fa fa fa 04 fa
  0x042e63c00a80: fa fa 04 fa fa fa 04 fa fa fa 00 fa fa fa 00 fa
  0x042e63c00a90: fa fa 00 04 fa fa 00 fa fa fa 00 00 fa fa 00 00
  0x042e63c00aa0: fa fa 00 04 fa fa 00 fa fa fa 00 00 fa fa 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc

**System Information** Operating system: Windows-10-10.0.19044-SP0 64 Bits Graphics card: AMD FirePro W2100 ATI Technologies Inc. 4.5.14831 Core Profile Context FireGL 21.Q2.1 27.20.21026.2006 **Blender Version** Broken: version: 3.2.0 Alpha, branch: master, commit date: 2022-03-16 11:58:22, hash: `be7855591e` Worked: n/a Caused by 541ba68991 **Short description of error** There's a buffer overrun on when selecting text inside the Text Editor. **Exact steps for others to reproduce the error** - Open up Text Editor - Type "abcdef asdf" - Use your mouse to drag-select "abcdef" and release the button - Observe below error The issue is that `txt_sel_to_buf` returns a buffer that is not null-terminated so the loop inside `WM_clipboard_text_set` walks off the end. That's for Windows at least. However, the `GHOST_putClipboard` api is probably similarly affected for all platforms. ``` ================================================================= ==17480==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x11f3ea0052e0 at pc 0x7ff78b266add bp 0x007327ffe550 sp 0x007327ffe558 READ of size 1 at 0x11f3ea0052e0 thread T0 - 0 0x7ff78b266adc in WM_clipboard_text_set E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_window.c:1732 - 1 0x7ff78ed1c5c5 in text_cursor_set_exit E:\source\blender-git\blender\source\blender\editors\space_text\text_ops.c:3247 - 2 0x7ff78ed1cdcf in text_selection_set_modal E:\source\blender-git\blender\source\blender\editors\space_text\text_ops.c:3289 - 3 0x7ff78b2a2e73 in wm_handler_operator_call E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:2282 - 4 0x7ff78b2a7e0e in wm_handlers_do_intern E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:3143 - 5 0x7ff78b2a80f4 in wm_handlers_do E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:3195 - 6 0x7ff78b2952f9 in wm_event_do_handlers E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:3763 - 7 0x7ff78b24754d in WM_main E:\source\blender-git\blender\source\blender\windowmanager\intern\wm.c:623 - 8 0x7ff789c5f29b in main E:\source\blender-git\blender\source\creator\creator.c:544 - 9 0x7ff799ccbdc8 in invoke_main d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78 - 10 0x7ff799ccbd1d in __scrt_common_main_seh d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 - 11 0x7ff799ccbbdd in __scrt_common_main d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:330 - 12 0x7ff799ccbe3d in mainCRTStartup d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_main.cpp:16 - 13 0x7ff8827a7033 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017033) #14 0x7ff8839a2650 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180052650) 0x11f3ea0052e0 is located 0 bytes to the right of 16-byte region [0x11f3ea0052d0,0x11f3ea0052e0) allocated by thread T0 here: - 0 0x7fff8fa2f211 in _asan_wrap_GlobalSize+0x4c50b (E:\source\blender-git\build-full-asan\bin\Debug\clang_rt.asan_dbg_dynamic-x86_64.dll+0x18004f211) - 1 0x7ff799a6b769 in MEM_lockfree_mallocN E:\source\blender-git\blender\intern\guardedalloc\intern\mallocn_lockfree_impl.c:263 - 2 0x7ff78a7a70c2 in txt_sel_to_buf E:\source\blender-git\blender\source\blender\blenkernel\intern\text.c:1503 - 3 0x7ff78ed1c5b4 in text_cursor_set_exit E:\source\blender-git\blender\source\blender\editors\space_text\text_ops.c:3246 - 4 0x7ff78ed1cdcf in text_selection_set_modal E:\source\blender-git\blender\source\blender\editors\space_text\text_ops.c:3289 - 5 0x7ff78b2a2e73 in wm_handler_operator_call E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:2282 - 6 0x7ff78b2a7e0e in wm_handlers_do_intern E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:3143 - 7 0x7ff78b2a80f4 in wm_handlers_do E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:3195 - 8 0x7ff78b2952f9 in wm_event_do_handlers E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_event_system.c:3763 - 9 0x7ff78b24754d in WM_main E:\source\blender-git\blender\source\blender\windowmanager\intern\wm.c:623 - 10 0x7ff789c5f29b in main E:\source\blender-git\blender\source\creator\creator.c:544 - 11 0x7ff799ccbdc8 in invoke_main d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78 - 12 0x7ff799ccbd1d in __scrt_common_main_seh d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 - 13 0x7ff799ccbbdd in __scrt_common_main d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:330 - 14 0x7ff799ccbe3d in mainCRTStartup d:\a01\_work\43\s\src\vctools\crt\vcstartup\src\startup\exe_main.cpp:16 - 15 0x7ff8827a7033 in BaseThreadInitThunk+0x13 (C:\WINDOWS\System32\KERNEL32.DLL+0x180017033) #16 0x7ff8839a2650 in RtlUserThreadStart+0x20 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x180052650) SUMMARY: AddressSanitizer: heap-buffer-overflow E:\source\blender-git\blender\source\blender\windowmanager\intern\wm_window.c:1732 in WM_clipboard_text_set Shadow bytes around the buggy address: 0x042e63c00a00: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x042e63c00a10: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x042e63c00a20: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x042e63c00a30: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd 0x042e63c00a40: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd =>0x042e63c00a50: fa fa fd fd fa fa 00 00 fa fa 00 00[fa]fa fd fa 0x042e63c00a60: fa fa fd fa fa fa 04 fa fa fa 04 fa fa fa 01 fa 0x042e63c00a70: fa fa 01 fa fa fa 00 fa fa fa 01 fa fa fa 04 fa 0x042e63c00a80: fa fa 04 fa fa fa 04 fa fa fa 00 fa fa fa 00 fa 0x042e63c00a90: fa fa 00 04 fa fa 00 fa fa fa 00 00 fa fa 00 00 0x042e63c00aa0: fa fa 00 04 fa fa 00 fa fa fa 00 00 fa fa 00 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ```

Jesse Yurkovich commented

2022-03-16 03:15:47 +01:00

Added subscriber: @deadpin

Jesse Yurkovich commented

2022-03-18 03:26:20 +01:00

Added subscriber: @ideasman42

Jesse Yurkovich commented

2022-03-18 03:26:20 +01:00

CC @ideasman42 Mind having a peek as this seems to be caused by the strncpy to memcpy change.

Germano Cavalcante commented

2022-03-18 14:00:07 +01:00

Added subscriber: @mano-wii

Germano Cavalcante commented

2022-03-18 14:00:07 +01:00

Changed status from 'Needs Triage' to: 'Confirmed'

Germano Cavalcante commented

2022-03-18 14:00:08 +01:00

Thanks for the report and for identifying the causing commit. I can confirm the problem.
Replacing the BLI_strcpy with memcpy in 541ba68991 indeed seems to have resulted in this problem.
The bug can also be confirmed by copying the same selection and pasting it anywhere.

Here a possible solution:

diff --git a/source/blender/blenkernel/intern/text.c b/source/blender/blenkernel/intern/text.c
index 43b2db0d62c..8759d7a0e5f 100644
--- a/source/blender/blenkernel/intern/text.c
+++ b/source/blender/blenkernel/intern/text.c
@@ -1501,7 +1501,8 @@ char *txt_sel_to_buf(Text *text, size_t *r_buf_strlen)
   if (linef == linel) {
     length = charl - charf;
     buf = MEM_mallocN(length + 1, "sel buffer");
-    memcpy(buf, linef->line + charf, length + 1);
+    memcpy(buf, linef->line + charf, length);
+    buf[length] = '\0';
   }
   else {
     /* Add 1 for the '\n' */

Thanks for the report and for identifying the causing commit. I can confirm the problem. Replacing the `BLI_strcpy` with `memcpy` in 541ba68991 indeed seems to have resulted in this problem. The bug can also be confirmed by copying the same selection and pasting it anywhere. Here a possible solution: ``` diff --git a/source/blender/blenkernel/intern/text.c b/source/blender/blenkernel/intern/text.c index 43b2db0d62c..8759d7a0e5f 100644 --- a/source/blender/blenkernel/intern/text.c +++ b/source/blender/blenkernel/intern/text.c @@ -1501,7 +1501,8 @@ char *txt_sel_to_buf(Text *text, size_t *r_buf_strlen) if (linef == linel) { length = charl - charf; buf = MEM_mallocN(length + 1, "sel buffer"); - memcpy(buf, linef->line + charf, length + 1); + memcpy(buf, linef->line + charf, length); + buf[length] = '\0'; } else { /* Add 1 for the '\n' */ ```

blender-admin commented

2022-03-21 03:32:34 +01:00

This issue was referenced by 8ecaa2d624

This issue was referenced by 8ecaa2d6247df7ff2e50e4a317295078a41cc7fe

Campbell Barton commented

2022-03-21 03:37:02 +01:00

Changed status from 'Confirmed' to: 'Resolved'

Campbell Barton closed this issue

2022-03-21 03:37:02 +01:00

Campbell Barton self-assigned this 2022-03-21 03:37:02 +01:00

Thomas Dinges added this to the 3.2 milestone 2023-02-08 15:51:07 +01:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

ASAN failure when selecting text in Text Editor #96510