Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

StreamPeerGZIP.start_compression randomly freezes Godot #87399

Closed
qarmin opened this issue Jan 20, 2024 · 1 comment · Fixed by #87448
Closed

StreamPeerGZIP.start_compression randomly freezes Godot #87399

qarmin opened this issue Jan 20, 2024 · 1 comment · Fixed by #87448
Milestone

Comments

@qarmin
Copy link
Contributor

qarmin commented Jan 20, 2024

Tested versions

4.3.dev.custom_build. 0bcc0e9

System information

Ubuntu 22.04 CI

Issue description

When executing (this code was automatically minimized, so it is possible, that an even more "minimal" project can be created)

extends Node
func _process(delta):
	var temp_variable4024 = StreamPeerGZIP.new()
	temp_variable4024.start_compression(false, -55)
	temp_variable4024.finish()
extends Node
func _process(delta):
	var temp_variable1409 = StreamPeerGZIP.new()
	temp_variable1409.start_compression(false, -82)
	temp_variable1409.put_string("")

Godot freezes(timeout is set to 60 seconds):

Godot Engine v4.3.dev.custom_build.0bcc0e92b - https://godotengine.org
modules/gdscript/gdscript_vm.cpp:719:13: runtime error: store to misaligned address 0x616001253e34 for type '<unknown> *', which requires 8 byte alignment
0x616001253e34: note: pointer points here
  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  0a 00 00 00 02 00 00 00  09 00 00 00 17 00 00 00
              ^ 
modules/gdscript/gdscript_vm.cpp:726:42: runtime error: load of misaligned address 0x616001253e34 for type '<unknown> *', which requires 8 byte alignment
0x616001253e34: note: pointer points here
  01 00 00 00 b2 b6 1a 53  49 56 00 00 00 00 00 00  0a 00 00 00 02 00 00 00  09 00 00 00 17 00 00 00
              ^ 
######################## Ending test ########################
core/templates/ring_buffer.h:199:7: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
core/templates/ring_buffer.h:179:20: runtime error: signed integer overflow: -2147483648 - 1 cannot be represented in type 'int'
core/templates/ring_buffer.h:165:13: runtime error: signed integer overflow: 20 - -2147483648 cannot be represented in type 'int'
timeout: sending signal TERM to command ‘xvfb-run’

The problem is that I cannot reproduce this locally, but only in CI

This example was found by Godot fuzzer - Qarminer, so it is quite unlikelly that this code could be used in real project, but still this should be handled gracefully.

Memory leaks or asan backtraces are visible when using Godot build with sanitizers support - https://github.com/qarmin/GodotBuilds/actions (linux -> linux-editor-sanitizers)

Steps to reproduce

Above

Minimal reproduction project (MRP)

Above

@AThousandShips
Copy link
Member

AThousandShips commented Jan 20, 2024

This should probably have a check for negative values, the method takes a 32 bit integer value and the mathematical operations internally probably doesn't handle negative values well either (it in fact casts it to an unsigned int, so the value is huge)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants