🔒 Locked

Access violation in CScriptArray

Started by MrK45 Aug 4 at 4:29 AM 1 replies 250+ views

Original Post

Aug 4 at 4:29 AM

I encountered AV using scriptarray addon in multithreaded application:

AddressSanitizer: heap-use-after-free on address 0x8407df54 at pc 0xb595b3ac bp 0x76fee57c sp 0x76fee574
READ of size 4 at 0x8407df54 thread T16
#0 0xb595b3ab in CScriptArray::EnumReferences(asIScriptEngine*) ../../src/3rdparty/angelscript_2.38.0/add_on/scriptarray/scriptarray.cpp:1919
#1 0xb5bc6b43 in asCScriptEngine::CallObjectMethod(void*, void*, asSSystemFunctionInterface*, asCScriptFunction*) const ../../source/as_scriptengine.cpp:4857
#2 0xb5bc69ab in asCScriptEngine::CallObjectMethod(void*, void*, int) const ../../source/as_scriptengine.cpp:4818
#3 0xb5bac097 in asCGarbageCollector::IdentifyGarbageWithCyclicRefs() ../../source/as_gc.cpp:739
#4 0xb5baad1b in asCGarbageCollector::GarbageCollect(unsigned long, unsigned int) ../../source/as_gc.cpp:243
#5 0xb5bc6f0b in asCScriptEngine::GarbageCollect(unsigned long, unsigned int) ../../source/as_scriptengine.cpp:5009
#6 0xb5b92263 in asCContext::Execute() ../../source/as_context.cpp:1559
#7 0xb5be40b3 in ScriptObjectFactory(asCObjectType const*, asCScriptEngine*) ../../source/as_scriptobject.cpp:82
#8 0xb5bc830f in asCScriptEngine::CreateScriptObject(asITypeInfo const*) ../../source/as_scriptengine.cpp:5381
#9 0xb594eddb in CScriptArray::Construct(SArrayBuffer*, unsigned int, unsigned int) ../../src/3rdparty/angelscript_2.38.0/add_on/scriptarray/scriptarray.cpp:1022
#10 0xb594cad7 in CScriptArray::Resize(int, unsigned int) ../../src/3rdparty/angelscript_2.38.0/add_on/scriptarray/scriptarray.cpp:790
#11 0xb594b88f in CScriptArray::Resize(unsigned int) ../../src/3rdparty/angelscript_2.38.0/add_on/scriptarray/scriptarray.cpp:712
0x8407df54 is located 4 bytes inside of 15-byte region [0x8407df50,0x8407df5f)
freed by thread T17 here:
#0 0xb6ac6b33 in __interceptor_free (/usr/lib/libasan.so.5+0xe2b33)
#1 0xb5baedd3 in asFreeMem ../../source/as_memory.cpp:179
#2 0xb594cb4f in CScriptArray::Resize(int, unsigned int) ../../src/3rdparty/angelscript_2.38.0/add_on/scriptarray/scriptarray.cpp:793

Prepared fix and posted it:

https://github.com/taushkanov/angelscript/tree/2.38.0-static

Topic Locked