R20-rc1 HeapUseAfterFree when changig Map during Download
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
widelands |
Fix Released
|
Critical
|
Unassigned |
Bug Description
Stnerl was hosting and seleted one Mpa, while still downloading the first on he switched to some other Map which made the game crash with ASAN:
InternetGaming: Client update on metaserver.
[Client] Pong!
[Client] Pong!
[Client] Pong!
[Client] Pong!
[Client] SETTING_MAP 'Astoria 2.R' 'maps/Astoria 2.R.wmf'
[Client] Pong!
[Client] Pong!
[Client] Pong!
[Client] SETTING_MAP 'Srawerb Ait' 'maps/Srawerb Ait.wmf'
=======
==3037==ERROR: AddressSanitizer: heap-use-after-free on address 0x6070003aeab8 at pc 0x00010e9d7cca bp 0x7ffee21e1060 sp 0x7ffee21e1058
READ of size 8 at 0x6070003aeab8 thread T0
#0 0x10e9d7cc9 in std::__
#1 0x10e9d7c84 in std::__
#2 0x10e9d7c64 in std::__
#3 0x10e9d7c22 in NetTransferFile
...
0x6070003aeab8 is located 56 bytes inside of 80-byte region [0x6070003aea80
freed by thread T0 here:
#0 0x115a77192 in wrap__ZdlPv (libclang_
#1 0x10e9bfe27 in GameClient:
#2 0x10e9b73c6 in GameClient:
#3 0x10e9b658b in GameClient::think() gameclient.cc:237
#4 0x10ef02b77 in FullscreenMenuL
previously allocated by thread T0 here:
#0 0x115a76b92 in wrap__Znwm (libclang_
#1 0x10e9c0aa3 in GameClient:
#2 0x10e9b73c6 in GameClient:
#3 0x10e9b658b in GameClient::think() gameclient.cc:237
#4 0x10ef02b77 in FullscreenMenuL
Complete Logs attached
Related branches
- Toni Förster: Approve (testing, playing, compiling)
-
Diff: 60 lines (+16/-3)3 files modifiedsrc/network/gameclient.cc (+6/-3)
src/network/gamehost.cc (+2/-0)
src/network/network.h (+8/-0)
- Klaus Halfmann: Approve (compile / test)
-
Diff: 128 lines (+15/-17)5 files modifiedsrc/network/gameclient.cc (+2/-6)
src/network/gameclient.h (+3/-1)
src/network/gamehost.cc (+3/-9)
src/network/gamehost.h (+3/-1)
src/network/network.h (+4/-0)
Changed in widelands: | |
assignee: | nobody → GunChleoc (gunchleoc) |
status: | Confirmed → In Progress |
importance: | High → Critical |
tags: | added: asan crash multiplayer |
Changed in widelands: | |
status: | In Progress → Fix Committed |
assignee: | GunChleoc (gunchleoc) → nobody |
[Client] SETTING_MAP '' '' Maps/fri01. wmf' 74228,0x11972f5 c0) malloc: *** error for object 0x1d00000009: pointer being freed was not allocated 74228,0x11972f5 c0) malloc: *** set a breakpoint in malloc_error_break to debug
[Client] Pong!
[Client] Pong!
[Client] SETTING_MAP 'After the Wood Gnomes' 'maps/My_Maps/After the Wood Gnomes.wmf'
[Client] Pong!
[Client] Pong!
[Client] SETTING_MAP 'De Grote Mandrenke' 'maps/My_
widelands(
widelands(
Abort trap: 6