Skip to content

Commit

Permalink
Prevent Use-After-Free Error
Browse files Browse the repository at this point in the history
Remarkably this change seems to prevent this use-after-free error:

==4284==ERROR: AddressSanitizer: heap-use-after-free on address 0x60700003cf50 at pc 0x7f22b904814b bp 0x7ffda5338480 sp 0x7ffda5337c30
READ of size 79 at 0x60700003cf50 thread T0
    #0 0x7f22b904814a in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
    #1 0x560430138ab6 in void std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct<char*>(char*, char*, std::forward_iterator_tag) [clone .constprop.0] (/home/aeva/Projects/tangerine/linux/build/Release/bin/tangerine+0x2f0ab6)
    #2 0x5604301421c6 in ifd::FileDialog::m_setDirectory(std::filesystem::__cxx11::path const&, bool) (/home/aeva/Projects/tangerine/linux/build/Release/bin/tangerine+0x2fa1c6)
    #3 0x5604301456aa in ifd::FileDialog::m_renderContent() (/home/aeva/Projects/tangerine/linux/build/Release/bin/tangerine+0x2fd6aa)
    #4 0x560430145e6b in ifd::FileDialog::m_renderFileDialog() (/home/aeva/Projects/tangerine/linux/build/Release/bin/tangerine+0x2fde6b)
    #5 0x5604301464f7 in ifd::FileDialog::IsDone(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (/home/aeva/Projects/tangerine/linux/build/Release/bin/tangerine+0x2fe4f7)
    #6 0x5604300678b4 in RenderUI(SDL_Window*, bool&) (/home/aeva/Projects/tangerine/linux/build/Release/bin/tangerine+0x21f8b4)
    #7 0x56043006fa0e in MainLoop() (/home/aeva/Projects/tangerine/linux/build/Release/bin/tangerine+0x227a0e)
    #8 0x56042fe898fa in main (/home/aeva/Projects/tangerine/linux/build/Release/bin/tangerine+0x418fa)
    #9 0x7f22b8967189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #10 0x7f22b8967244 in __libc_start_main_impl ../csu/libc-start.c:381
    #11 0x56042fe8b8c0 in _start (/home/aeva/Projects/tangerine/linux/build/Release/bin/tangerine+0x438c0)

0x60700003cf50 is located 0 bytes inside of 80-byte region [0x60700003cf50,0x60700003cfa0)
freed by thread T0 here:
    #0 0x7f22b90ba3c8 in operator delete(void*, unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:164
    #1 0x56043014210a in ifd::FileDialog::m_setDirectory(std::filesystem::__cxx11::path const&, bool) (/home/aeva/Projects/tangerine/linux/build/Release/bin/tangerine+0x2fa10a)

previously allocated by thread T0 here:
    #0 0x7f22b90b94c8 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95
    #1 0x560430138a9b in void std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct<char*>(char*, char*, std::forward_iterator_tag) [clone .constprop.0] (/home/aeva/Projects/tangerine/linux/build/Release/bin/tangerine+0x2f0a9b)
  • Loading branch information
Aeva committed May 10, 2023
1 parent 0bf5e46 commit 7a98d43
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 2 deletions.
2 changes: 1 addition & 1 deletion third_party/ImFileDialog/ImFileDialog.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -923,7 +923,7 @@ namespace ifd {
delete node;
node = nullptr;
}
void FileDialog::m_setDirectory(const std::filesystem::path& p, bool addHistory)
void FileDialog::m_setDirectory(const std::filesystem::path p, bool addHistory)
{
bool isSameDir = m_currentDirectory == p;

Expand Down
2 changes: 1 addition & 1 deletion third_party/ImFileDialog/ImFileDialog.h
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@ namespace ifd {
unsigned int m_sortColumn;
unsigned int m_sortDirection;
std::vector<FileData> m_content;
void m_setDirectory(const std::filesystem::path& p, bool addHistory = true);
void m_setDirectory(const std::filesystem::path p, bool addHistory = true);
void m_sortContent(unsigned int column, unsigned int sortDirection);
void m_renderContent();

Expand Down

0 comments on commit 7a98d43

Please sign in to comment.