Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Out-of-bounds seen cache array access when starting a new game #53103

Closed
BrettDong opened this issue Nov 29, 2021 · 7 comments · Fixed by #54571
Closed

Out-of-bounds seen cache array access when starting a new game #53103

BrettDong opened this issue Nov 29, 2021 · 7 comments · Fixed by #54571
Labels
<Bug> This needs to be fixed <Crash / Freeze> Fatal bug that results in hangs or crashes. (S2 - Confirmed) Bug that's been confirmed to exist

Comments

@BrettDong
Copy link
Member

Describe the bug

When starting a new game there is an out-of-bounds array access on seen_cache array in lightmap.cpp:

if( z == target_z ) {
seen_cache[origin.x][origin.y] = VISIBILITY_FULL;

src/lightmap.cpp:990:17: runtime error: index -4768 out of bounds for type 'float [132][132]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/lightmap.cpp:990:17 in 
    ...
    frame #4: 0x000000010a620ab8 libclang_rt.asan_osx_dynamic.dylib`__ubsan_handle_out_of_bounds_abort + 52
    frame #5: 0x000000010221e934 cataclysm-tiles`map::build_seen_cache(tripoint const&, int) + 4700
    frame #6: 0x00000001024735a0 cataclysm-tiles`map::build_map_cache(int, bool) + 1616
    frame #7: 0x0000000101594050 cataclysm-tiles`game::start_game() + 2976
    frame #8: 0x00000001023bbdb4 cataclysm-tiles`main_menu::new_character_tab() + 5704
    frame #9: 0x00000001023b93e4 cataclysm-tiles`main_menu::opening_screen() + 6812
    frame #10: 0x0000000102398cf8 cataclysm-tiles`main + 7856
    frame #11: 0x00000001a0f89430 libdyld.dylib`start + 4

Steps to reproduce

  1. Compile with Address Sanitizer and Undefined Behaviour Sanitizer: make RELEASE=1 SANITIZE=address,undefined cataclysm -j4
  2. Start a new game by pressing N -> N [Play Now]
  3. Wait for JSON data loading to finish
  4. Crash on "Please wait as we build your world"

Expected behavior

Game starts without memory access errors.

Screenshots

No response

Versions and configuration

  • OS: macOS 11.6.1
  • Compiler: LLVM Community 13.0.0 ARM64
  • Game Version: d8a51aa

Additional context

No response

@BrettDong BrettDong added the <Bug> This needs to be fixed label Nov 29, 2021
@BrettDong
Copy link
Member Author

This is probably also the cause of #52300.

@BrettDong BrettDong added the <Crash / Freeze> Fatal bug that results in hangs or crashes. label Nov 30, 2021
@wapcaplet
Copy link
Contributor

Confirmed, when compiled with SANITIZE=address,undefined, I get the following runtime error on starting a new game:

src/lightmap.cpp:990:17: runtime error: index -2176 out of bounds for type 'float [132][132]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior src/lightmap.cpp:990:17
  • OS: Linux
    • OS Version: Distributor ID: Pop; Description: Pop!_OS 20.04 LTS; Release: 20.04; Codename: focal;
  • Game Version: 0.F-4108-gfa916867f5 [64-bit]
  • Graphics Version: Tiles
  • Game Language: System language []
  • Mods loaded: [
    Dark Days Ahead [dda],
    Disable NPC Needs [no_npc_food],
    No Fungal Growth [no_fungal_growth],
    Bionic Professions [package_bionic_professions]
    ]

@wapcaplet wapcaplet added the (S2 - Confirmed) Bug that's been confirmed to exist label Nov 30, 2021
@Inglonias
Copy link
Contributor

Assuming this is the cause of #52300, I'm not seeing it anymore. I'm not confident enough to close it just yet, but is there a chance this resolved itself? I don't see any recent merges that would do it...

@BrettDong
Copy link
Member Author

Assuming this is the cause of #52300, I'm not seeing it anymore. I'm not confident enough to close it just yet, but is there a chance this resolved itself? I don't see any recent merges that would do it...

Memory access violation does not necessarily cause a user visible crash. It could silently overwrite something in memory while remain undiscovered.

@anothersimulacrum
Copy link
Member

anothersimulacrum commented Dec 31, 2021

Looks like #36570 (well, similar to)

@BrettDong
Copy link
Member Author

Similar symptom, but a different cause this time.

@anothersimulacrum
Copy link
Member

anothersimulacrum commented Jan 1, 2022

This occurs because the player's position seems to be (20, 10, -500) in absolute coordinates, but after this

set_abs_sub( w.raw() );

that becomes out of the bounds of the map - I'm getting values like (-1432, -4034, -500).

d9ff1a6 is the first bad commit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
<Bug> This needs to be fixed <Crash / Freeze> Fatal bug that results in hangs or crashes. (S2 - Confirmed) Bug that's been confirmed to exist
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants