Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Executing collide function in ConvexPolygonShape2D crashes Godot #46137

Closed
Tracked by #45334
qarmin opened this issue Feb 17, 2021 · 1 comment · Fixed by #47666
Closed
Tracked by #45334

Executing collide function in ConvexPolygonShape2D crashes Godot #46137

qarmin opened this issue Feb 17, 2021 · 1 comment · Fixed by #47666

Comments

@qarmin
Copy link
Contributor

qarmin commented Feb 17, 2021

Godot version:
Godot 3.2.4 rc 2

Issue description:
Executing

var q_ConvexPolygonShape2D : ConvexPolygonShape2D = ConvexPolygonShape2D.new()

func _process(_delta : float) -> void:
	var p_object_0 = LineShape2D.new()
	q_ConvexPolygonShape2D.collide(Transform2D(Vector2(100, 100), Vector2(100, 100), Vector2(100, 100)), p_object_0, Transform2D(Vector2(100, 100), Vector2(100, 100), Vector2(100, 100)))

crashes and shows this error in address sanitizer

==34653==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd7aeadc40 at pc 0x0000043d3de0 bp 0x7ffd7aead8d0 sp 0x7ffd7aead8c0
READ of size 4 at 0x7ffd7aeadc40 thread T0
    #0 0x43d3ddf in Transform2D::tdoty(Vector2 const&) const core/math/transform_2d.h:52
    #1 0x43d4cb4 in Transform2D::xform(Vector2 const&) const core/math/transform_2d.h:155
    #2 0x10a5d55d in CollisionSolver2DSW::solve_static_line(Shape2DSW const*, Transform2D const&, Shape2DSW const*, Transform2D const&, void (*)(Vector2 const&, Vector2 const&, void*), void*, bool) servers/physics_2d/collision_solver_2d_sw.cpp:56
    #3 0x10a61cce in CollisionSolver2DSW::solve(Shape2DSW const*, Transform2D const&, Vector2 const&, Shape2DSW const*, Transform2D const&, Vector2 const&, void (*)(Vector2 const&, Vector2 const&, void*), void*, Vector2*, float, float) servers/physics_2d/collision_solver_2d_sw.cpp:220
    #4 0xff1a5bf in Physics2DServerSW::shape_collide(RID, Transform2D const&, Vector2 const&, RID, Transform2D const&, Vector2 const&, Vector2*, int, int&) servers/physics_2d/physics_2d_server_sw.cpp:223
    #5 0xff8e736 in Physics2DServerWrapMT::shape_collide(RID, Transform2D const&, Vector2 const&, RID, Transform2D const&, Vector2 const&, Vector2*, int, int&) servers/physics_2d/physics_2d_server_wrap_mt.h:100
    #6 0xeedd9ba in Shape2D::collide(Transform2D const&, Ref<Shape2D> const&, Transform2D const&) scene/resources/shape_2d.cpp:59
    #7 0xeef9ebf in MethodBind3R<bool, Transform2D const&, Ref<Shape2D> const&, Transform2D const&>::call(Object*, Variant const**, int, Variant::CallError&) core/method_bind.gen.inc:2505
    #8 0x1131b301 in Object::call(StringName const&, Variant const**, int, Variant::CallError&) core/object.cpp:919
    #9 0x1159c2dd in Variant::call_ptr(StringName const&, Variant const**, int, Variant*, Variant::CallError&) core/variant_call.cpp:1129
    #10 0x1d4c957 in GDScriptFunction::call(GDScriptInstance*, Variant const**, int, Variant::CallError&, GDScriptFunction::CallState*) modules/gdscript/gdscript_function.cpp:1086
    #11 0x1b7cbc2 in GDScriptInstance::call_multilevel(StringName const&, Variant const**, int) modules/gdscript/gdscript.cpp:1254
    #12 0xbef2a07 in Node::_notification(int) scene/main/node.cpp:60
    #13 0x1a29b69 in Node::_notificationv(int, bool) scene/main/node.h:46
    #14 0x1a2bfde in CanvasItem::_notificationv(int, bool) scene/2d/canvas_item.h:166
    #15 0xd9c89e4 in Node2D::_notificationv(int, bool) scene/2d/node_2d.h:38
    #16 0x1131b79b in Object::notification(int, bool) core/object.cpp:929
    #17 0xc01d9b3 in SceneTree::_notify_group_pause(StringName const&, int) scene/main/scene_tree.cpp:988
    #18 0xc00e275 in SceneTree::idle(float) scene/main/scene_tree.cpp:528
    #19 0x189006a in Main::iteration() main/main.cpp:2108
    #20 0x1780816 in OS_X11::run() platform/x11/os_x11.cpp:3634
    #21 0x16ee466 in main platform/x11/godot_x11.cpp:56
    #22 0x7f8973aa20b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #23 0x16ee07d in _start (/usr/bin/godots+0x16ee07d)

Address 0x7ffd7aeadc40 is located in stack of thread T0 at offset 496 in frame
    #0 0x10a5c43d in CollisionSolver2DSW::solve_static_line(Shape2DSW const*, Transform2D const&, Shape2DSW const*, Transform2D const&, void (*)(Vector2 const&, Vector2 const&, void*), void*, bool) servers/physics_2d/collision_solver_2d_sw.cpp:37

  This frame has 17 object(s):
    [48, 52) '<unknown>'
    [64, 68) 'support_count' (line 48)
    [80, 84) '<unknown>'
    [96, 104) 'n' (line 43)
    [128, 136) '<unknown>'
    [160, 168) '<unknown>'
    [192, 200) 'p' (line 44)
    [224, 232) '<unknown>'
    [256, 264) '<unknown>'
    [288, 296) '<unknown>'
    [320, 328) '<unknown>'
    [352, 360) '<unknown>'
    [384, 392) '<unknown>'
    [416, 424) 'support_A' (line 62)
    [448, 456) '<unknown>'
    [480, 496) 'supports' (line 47) <== Memory access at offset 496 overflows this variable
    [512, 536) '<unknown>'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow core/math/transform_2d.h:52 in Transform2D::tdoty(Vector2 const&) const

@qarmin
Copy link
Contributor Author

qarmin commented Apr 4, 2021

Probably inside collide function is needed check if shape is null e.g. ERR_FAIL_COND(p_shape.is_null());

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants