| 1 | -> while the ending credits scroll
|
|---|
| 2 |
|
|---|
| 3 | WRITE of size 1 at 0x63100051473f thread T0
|
|---|
| 4 | #0 0x1002d101a in Scumm::CharsetRendererV7::drawCharV7(unsigned char*, Common::Rect&, int, int, int, short, Scumm::TextStyleFlags, unsigned char) charset.cpp:2024
|
|---|
| 5 | #1 0x1002d15a2 in non-virtual thunk to Scumm::CharsetRendererV7::drawCharV7(unsigned char*, Common::Rect&, int, int, int, short, Scumm::TextStyleFlags, unsigned char) charset.cpp
|
|---|
| 6 | #2 0x100f7717a in Scumm::TextRenderer_v7::drawSubstring(char const*, unsigned int, unsigned char*, Common::Rect&, int, int, int, short&, Scumm::TextStyleFlags) string_v7.cpp:173
|
|---|
| 7 | #3 0x100f78440 in Scumm::TextRenderer_v7::drawString(char const*, unsigned char*, Common::Rect&, int, int, int, short, Scumm::TextStyleFlags) string_v7.cpp:223
|
|---|
| 8 | #4 0x100f844ee in Scumm::ScummEngine_v7::drawBlastTexts() string_v7.cpp:486
|
|---|
| 9 | #5 0x1004e2dc1 in Scumm::ScummEngine_v6::drawDirtyScreenParts() gfx.cpp:552
|
|---|
| 10 | #6 0x100e09820 in Scumm::ScummEngine::scummLoop(int) scumm.cpp:2587
|
|---|
| 11 | #7 0x100dff3a2 in Scumm::ScummEngine::go() scumm.cpp:2289
|
|---|
| 12 | #8 0x100e2a63f in Scumm::ScummEngine::run() scumm.h:510
|
|---|
| 13 | #9 0x10008807d in runGame(Plugin const*, Plugin const*, OSystem&, Common::String const&) main.cpp:318
|
|---|
| 14 | #10 0x10007c463 in scummvm_main main.cpp:619
|
|---|
| 15 | #11 0x10006bffa in main macosx-main.cpp:44
|
|---|
| 16 | #12 0x1042dd52d in start+0x1cd (dyld:x86_64+0x552d)
|
|---|
| 17 |
|
|---|
| 18 | 0x63100051473f is located 193 bytes to the left of 68226-byte region [0x631000514800,0x631000525282)
|
|---|
| 19 | allocated by thread T0 here:
|
|---|
| 20 | #0 0x104d7731d in wrap__Znam+0x7d (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x5c31d)
|
|---|
| 21 | #1 0x100a6de0d in Scumm::ResourceManager::createResource(Scumm::ResType, unsigned short, unsigned int) resource.cpp:860
|
|---|
| 22 | #2 0x1004d67e9 in Scumm::ScummEngine::initVirtScreen(Scumm::VirtScreenNumber, int, int, int, bool, bool) gfx.cpp:443
|
|---|
| 23 | #3 0x1004ed616 in Scumm::ScummEngine::initBGBuffers(int) gfx.cpp:1015
|
|---|
| 24 | #4 0x100ae527b in Scumm::ScummEngine::loadState(int, bool, Common::String&) saveload.cpp:894
|
|---|
| 25 | #5 0x100ad8ef8 in Scumm::ScummEngine::loadState(int, bool) saveload.cpp:632
|
|---|
| 26 | #6 0x100dfdc2b in Scumm::ScummEngine::go() scumm.cpp:2226
|
|---|
| 27 | #7 0x100e2a63f in Scumm::ScummEngine::run() scumm.h:510
|
|---|
| 28 | #8 0x10008807d in runGame(Plugin const*, Plugin const*, OSystem&, Common::String const&) main.cpp:318
|
|---|
| 29 | #9 0x10007c463 in scummvm_main main.cpp:619
|
|---|
| 30 | #10 0x10006bffa in main macosx-main.cpp:44
|
|---|
| 31 | #11 0x1042dd52d in start+0x1cd (dyld:x86_64+0x552d)
|
|---|
| 32 |
|
|---|
| 33 | SUMMARY: AddressSanitizer: heap-buffer-overflow charset.cpp:2024 in Scumm::CharsetRendererV7::drawCharV7(unsigned char*, Common::Rect&, int, int, int, short, Scumm::TextStyleFlags, unsigned char)
|
|---|
| 34 | Shadow bytes around the buggy address:
|
|---|
| 35 | 0x1c62000a2890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 36 | 0x1c62000a28a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 37 | 0x1c62000a28b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 38 | 0x1c62000a28c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 39 | 0x1c62000a28d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 40 | =>0x1c62000a28e0: fa fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa
|
|---|
| 41 | 0x1c62000a28f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
|---|
| 42 | 0x1c62000a2900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|---|
| 43 | 0x1c62000a2910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|---|
| 44 | 0x1c62000a2920: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|---|
| 45 | 0x1c62000a2930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|---|
| 46 | Shadow byte legend (one shadow byte represents 8 application bytes):
|
|---|
| 47 | Addressable: 00
|
|---|
| 48 | Partially addressable: 01 02 03 04 05 06 07
|
|---|
| 49 | Heap left redzone: fa
|
|---|
| 50 | Freed heap region: fd
|
|---|
| 51 | Stack left redzone: f1
|
|---|
| 52 | Stack mid redzone: f2
|
|---|
| 53 | Stack right redzone: f3
|
|---|
| 54 | Stack after return: f5
|
|---|
| 55 | Stack use after scope: f8
|
|---|
| 56 | Global redzone: f9
|
|---|
| 57 | Global init order: f6
|
|---|
| 58 | Poisoned by user: f7
|
|---|
| 59 | Container overflow: fc
|
|---|
| 60 | Array cookie: ac
|
|---|
| 61 | Intra object redzone: bb
|
|---|
| 62 | ASan internal: fe
|
|---|
| 63 | Left alloca redzone: ca
|
|---|
| 64 | Right alloca redzone: cb
|
|---|
| 65 | ==6197==ABORTING
|
|---|
| 66 |
|
|---|
| 67 | frame #5: 0x00000001002d101b scummvm`Scumm::CharsetRendererV7::drawCharV7(this=0x000060e000083ec0, buffer="##############################################################################################################", clipRect=0x000063200001330e, x=134, y=0, pitch=320, col=146, flags=kStyleAlignCenter, chr='\x8a') at charset.cpp:2024:10
|
|---|
| 68 | 2021 for (int dx = x; dx < x + _origWidth; ++dx) {
|
|---|
| 69 | 2022 byte color = (bits >> (8 - bpp)) & 0xFF;
|
|---|
| 70 | 2023 if (color && dx >= 0 && dx < x + width && y >= 0)
|
|---|
| 71 | -> 2024 *dst = cmap[color];
|
|---|
| 72 | 2025 dst++;
|
|---|
| 73 | 2026 bits <<= bpp;
|
|---|
| 74 | 2027 numbits -= bpp;
|
|---|
| 75 |
|
|---|
| 76 | (lldb) p dx
|
|---|
| 77 | (int) $1 = 135
|
|---|
| 78 |
|
|---|
| 79 | (lldb) p x
|
|---|
| 80 | (int) $2 = 134
|
|---|
| 81 |
|
|---|
| 82 | (lldb) p _origWidth
|
|---|
| 83 | (int) $3 = 8
|
|---|
| 84 |
|
|---|
| 85 | (lldb) p/d color
|
|---|
| 86 | (byte) $5 = 2
|
|---|
| 87 |
|
|---|
| 88 | (lldb) p width
|
|---|
| 89 | (int) $6 = 8
|
|---|
| 90 |
|
|---|
| 91 | (lldb) p/d bpp
|
|---|
| 92 | (uint8) $8 = 2
|
|---|
| 93 |
|
|---|
| 94 | (lldb) x/16b cmap
|
|---|
| 95 | 0x63200000f468: 0x00 0x92 0x00 0x03 0x04 0x05 0x06 0x07
|
|---|
| 96 | 0x63200000f470: 0x08 0x09 0x0a 0x0b 0x0c 0x0d 0x0e 0x0f
|
|---|
| 97 |
|
|---|
| 98 | (lldb) p/d numbits
|
|---|
| 99 | (byte) $17 = 6
|
|---|
