Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes to CMT plugins runtime crash on MSVC #5

Merged
merged 1 commit into from
Nov 9, 2023
Merged

Fixes to CMT plugins runtime crash on MSVC #5

merged 1 commit into from
Nov 9, 2023

Conversation

Rossmaxx
Copy link
Contributor

@Rossmaxx Rossmaxx commented Nov 6, 2023

CMT plugins were causing a heap corruption overflow because of attempts to delete already delete data. The code before was crash prone due to double deletion. I would be upstreaming this change.

@tresf tresf merged commit 835108b into LMMS:lmms Nov 9, 2023
@DomClark
Copy link
Member

DomClark commented Nov 9, 2023

The only way the original code could have caused a double deletion of m_ppfPorts is if CMT_PluginInstance itself was double-deleted. This earlier double deletion should be fixed instead, which will then automatically do the right thing with m_ppfPorts. You should never need to worry about leaving an object in a particular state after the destructor returns - at that point, the object should never be touched again. Also, you don't need to guard against passing null pointers to delete[] (or normal delete).

@Rossmaxx
Copy link
Contributor Author

This earlier double deletion should be fixed instead

I agree with that but since this got merged, will need to revert this and open another pr, which is a tad bit more effort and since the issue has been fixed (though in a less intuitive way), I don't really want to do that. If i run into any issues with this approach, I will consider this.

Also, you don't need to guard against passing null pointers to delete[] (or normal delete).

That guard came because I'm setting the pointer to nullptr after I delete m_ppfPorts, so that the next time the destructor is being called, if m_ppfPorts is nullptr, the destructor does nothing, which basically nullifies the destructor call.

@tresf
Copy link
Member

tresf commented Nov 11, 2023

The only way the original code could have caused a double deletion of m_ppfPorts is if CMT_PluginInstance itself was double-deleted. This earlier double deletion should be fixed instead, which will then automatically do the right thing with m_ppfPorts. You should never need to worry about leaving an object in a particular state after the destructor returns - at that point, the object should never be touched again. Also, you don't need to guard against passing null pointers to delete[] (or normal delete).

So should only the m_ppfPorts = nullptr; // set pointer to nullptr after deletion remain?

@DomClark
Copy link
Member

DomClark commented May 9, 2024

I found the actual issue here. When m_ppfPorts is deleted, the CRT reports the following error:

HEAP CORRUPTION DETECTED: after Normal block (#<block number, may vary>) at <address, may vary>.
CRT detected that the application wrote to memory after end of heap buffer.

This isn't a double-free, nor is it caused by one; it's a heap buffer overflow. I put a code breakpoint after the allocation of m_ppfPorts, then, when that triggered, put a data breakpoint at the address just after that buffer on the heap. The data breakpoint triggered in CMT_ConnectPort, called from lmms::LadspaManager::connectPort, with a port index of 4. Sure enough, the plugin allocates space for four ports, but specifies five in its descriptor. This can easily be fixed by allocating the correct number of ports. I've checked the other plugins and this appears to be the only such issue.

DomClark added a commit to DomClark/cmt that referenced this pull request May 9, 2024
This reverts commit 835108b.

This change is redundant and does not fix the bug it was intended to.
DomClark added a commit that referenced this pull request May 10, 2024
This reverts commit 835108b.

This change is redundant and does not fix the bug it was intended to.
@Rossmaxx Rossmaxx deleted the crash-fix branch May 10, 2024 12:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants