GNOME Bugzilla – Bug 788459
RETRO_ENVIRONMENT_GET_VARIABLE_UPDATE casts bool* to gboolean* and breaks caller
Last modified: 2017-11-02 11:07:30 UTC
When retro core uses environment_cb to get info about variable updates, it passes pointer to bool (1 byte) value. This pointer is then treated as pointer to gboolean (4 bytes) in retro-gtk/retro-environment.c and so its function get_variable_update overwrites not only expected, but also three following bytes of caller stack, causing everything to come down crashing. Link for example: This is caller - https://github.com/libretro/snes9x/blob/master/libretro/libretro.cpp#L951 and this get called - https://github.com/GNOME/retro-gtk/blob/f9f780192e5c5def12b31d782b9038e29aaa4dd4/retro-gtk/retro-environment.c#L212 Error & stack trace *** stack smashing detected ***: <unknown> terminated Process 11223 stopped * thread #1, name = 'python2', stop reason = signal SIGABRT frame #0: 0x00007ffff76328a0 libc.so.6`__GI_raise + 272 libc.so.6`__GI_raise: -> 0x7ffff76328a0 <+272>: movq 0x108(%rsp), %rcx 0x7ffff76328a8 <+280>: xorq %fs:0x28, %rcx 0x7ffff76328b1 <+289>: movl %r8d, %eax 0x7ffff76328b4 <+292>: jne 0x7ffff76328ce ; <+318> (lldb) bt (lldb) bt * thread #1, name = 'python2', stop reason = signal SIGABRT * frame #0: 0x00007ffff76328a0 libc.so.6`__GI_raise + 272 frame #1: 0x00007ffff7633f09 libc.so.6`__GI_abort + 457 frame #2: 0x00007ffff7675517 libc.so.6`__libc_message + 631 frame #3: 0x00007ffff77056bf libc.so.6`__GI___fortify_fail_abort + 47 frame #4: 0x00007ffff7705682 libc.so.6`__stack_chk_fail_local + 18 frame #5: 0x00007fffdb5b9ad2 snes9x_libretro.so`::retro_run() at libretro.cpp:962 frame #6: 0x00007fffe8227fae libretro-gtk.so.0`retro_core_run + 30 Changing argument type of get_variable_update to actual (bool*) or other 1 byte long value, such as (gchar*) fixes the problem.
Created attachment 362798 [details] [review] environment: Replace gboolean by bool in get_variable_update() This avoid some crashes.
Attachment 362798 [details] pushed as 5bf71d8 - environment: Replace gboolean by bool in get_variable_update()