Use of deallocated memory from statistics menu
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
widelands |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
When closing the statistics menu (window with 4 buttons)
and closing one of the other statistics menus. The code
tries to change the style of a button that has already beend freed:
==39835==ERROR: AddressSanitizer: heap-use-after-free on address 0x613000a7fdc4 at pc 0x00010236a898 bp 0x7ffeee7bd4d0 sp 0x7ffeee7bd4c8
WRITE of size 4 at 0x613000a7fdc4 thread T0
#0 0x10236a897 in UI::Button:
...
#7 0x10253f36b in UI::UniqueWindo
#8 0x102990787 in GeneralStatisti
0x613000a7fdc4 is located 260 bytes inside of 328-byte region [0x613000a7fcc0
freed by thread T0 here:
#1 0x102361701 in UI::Button:
#2 0x10246fd77 in UI::Panel:
..
#6 0x1028e5cc3 in GameStatisticsM
reviously allocated by thread T0 here:
#1 0x1028e3fae in GameStatisticsM
This will result in memory corruption with +/- bad results.
The same will happen if you reopen any statics menu, so
keeping the window open as a workaround will not help.
I will spend some hour now to find some workaround, but maybe this is broken by design.
Related branches
- SirVer: Approve
-
Diff: 199 lines (+20/-56)7 files modifiedsrc/ui_basic/unique_window.cc (+2/-21)
src/ui_basic/unique_window.h (+6/-14)
src/wui/game_options_menu.cc (+5/-2)
src/wui/game_statistics_menu.cc (+4/-6)
src/wui/game_statistics_menu.h (+0/-4)
src/wui/interactive_base.cc (+3/-5)
src/wui/interactive_base.h (+0/-4)
tags: | added: crash |
tags: | added: asan |
Changed in widelands: | |
status: | New → In Progress |
assignee: | nobody → GunChleoc (gunchleoc) |
milestone: | none → build20-rc1 |
Changed in widelands: | |
status: | In Progress → Fix Committed |
assignee: | GunChleoc (gunchleoc) → nobody |
This will _not_ happen when using the 'I' command alow.
I _will_ happen if the statitics menu was opend and then closed.