After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 788459 - RETRO_ENVIRONMENT_GET_VARIABLE_UPDATE casts bool* to gboolean* and breaks caller
RETRO_ENVIRONMENT_GET_VARIABLE_UPDATE casts bool* to gboolean* and breaks caller
Status: RESOLVED FIXED
Product: gnome-games
Classification: Core
Component: retro-gtk
3.26.x
Other Linux
: Normal normal
: ---
Assigned To: GNOME Games maintainers
Depends on:
Blocks:
 
 
Reported: 2017-10-03 08:46 UTC by kozec
Modified: 2017-11-02 11:07 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
environment: Replace gboolean by bool in get_variable_update() (1.51 KB, patch)
2017-11-02 08:55 UTC, Adrien Plazas
committed Details | Review

Description kozec 2017-10-03 08:46:53 UTC
When retro core uses environment_cb to get info about variable updates, it passes pointer to bool (1 byte) value. This pointer is then treated as pointer to gboolean (4 bytes) in retro-gtk/retro-environment.c and so its function get_variable_update overwrites not only expected, but also three following bytes of caller stack, causing everything to come down crashing.

Link for example:
This is caller - https://github.com/libretro/snes9x/blob/master/libretro/libretro.cpp#L951
and this get called - https://github.com/GNOME/retro-gtk/blob/f9f780192e5c5def12b31d782b9038e29aaa4dd4/retro-gtk/retro-environment.c#L212

Error & stack trace

*** stack smashing detected ***: <unknown> terminated
Process 11223 stopped
* thread #1, name = 'python2', stop reason = signal SIGABRT
    frame #0: 0x00007ffff76328a0 libc.so.6`__GI_raise + 272
libc.so.6`__GI_raise:
->  0x7ffff76328a0 <+272>: movq   0x108(%rsp), %rcx
    0x7ffff76328a8 <+280>: xorq   %fs:0x28, %rcx
    0x7ffff76328b1 <+289>: movl   %r8d, %eax
    0x7ffff76328b4 <+292>: jne    0x7ffff76328ce            ; <+318>
(lldb) bt
(lldb) bt
* thread #1, name = 'python2', stop reason = signal SIGABRT
  * frame #0: 0x00007ffff76328a0 libc.so.6`__GI_raise + 272
    frame #1: 0x00007ffff7633f09 libc.so.6`__GI_abort + 457
    frame #2: 0x00007ffff7675517 libc.so.6`__libc_message + 631
    frame #3: 0x00007ffff77056bf libc.so.6`__GI___fortify_fail_abort + 47
    frame #4: 0x00007ffff7705682 libc.so.6`__stack_chk_fail_local + 18
    frame #5: 0x00007fffdb5b9ad2 snes9x_libretro.so`::retro_run() at libretro.cpp:962
    frame #6: 0x00007fffe8227fae libretro-gtk.so.0`retro_core_run + 30


Changing argument type of get_variable_update to actual (bool*) or other 1 byte long value, such as (gchar*) fixes the problem.
Comment 1 Adrien Plazas 2017-11-02 08:55:41 UTC
Created attachment 362798 [details] [review]
environment: Replace gboolean by bool in get_variable_update()

This avoid some crashes.
Comment 2 Adrien Plazas 2017-11-02 11:05:58 UTC
Attachment 362798 [details] pushed as 5bf71d8 - environment: Replace gboolean by bool in get_variable_update()