{"action":"created","issue":{"url":"https://api.github.com/repos/libretro/RetroArch/issues/7508","repository_url":"https://api.github.com/repos/libretro/RetroArch","labels_url":"https://api.github.com/repos/libretro/RetroArch/issues/7508/labels{/name}","comments_url":"https://api.github.com/repos/libretro/RetroArch/issues/7508/comments","events_url":"https://api.github.com/repos/libretro/RetroArch/issues/7508/events","html_url":"https://github.com/libretro/RetroArch/issues/7508","id":375290288,"node_id":"MDU6SXNzdWUzNzUyOTAyODg=","number":7508,"title":"Stack overflow when switching language","user":{"login":"bparker06","id":2433242,"node_id":"MDQ6VXNlcjI0MzMyNDI=","avatar_url":"https://avatars1.githubusercontent.com/u/2433242?v=4","gravatar_id":"","url":"https://api.github.com/users/bparker06","html_url":"https://github.com/bparker06","followers_url":"https://api.github.com/users/bparker06/followers","following_url":"https://api.github.com/users/bparker06/following{/other_user}","gists_url":"https://api.github.com/users/bparker06/gists{/gist_id}","starred_url":"https://api.github.com/users/bparker06/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bparker06/subscriptions","organizations_url":"https://api.github.com/users/bparker06/orgs","repos_url":"https://api.github.com/users/bparker06/repos","events_url":"https://api.github.com/users/bparker06/events{/privacy}","received_events_url":"https://api.github.com/users/bparker06/received_events","type":"User","site_admin":false},"labels":[{"id":1172301493,"node_id":"MDU6TGFiZWwxMTcyMzAxNDkz","url":"https://api.github.com/repos/libretro/RetroArch/labels/bug:%20arabic%20text","name":"bug: arabic text","color":"d4c5f9","default":false},{"id":253577301,"node_id":"MDU6TGFiZWwyNTM1NzczMDE=","url":"https://api.github.com/repos/libretro/RetroArch/labels/bug:%20major","name":"bug: major","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-10-30T02:16:20Z","updated_at":"2018-12-26T02:16:58Z","closed_at":null,"author_association":"MEMBER","body":"## Description\r\n\r\nWhen running under ASAN on Linux, trying to change the language in certain circumstances produces a stack overflow:\r\n\r\n```\r\ngfx/font_driver.c:770:46: runtime error: left shift of negative value -40\r\ngfx/font_driver.c:789:34: runtime error: left shift of negative value -39\r\ngfx/font_driver.c:819:42: runtime error: left shift of negative value -40\r\n=================================================================\r\n==7514==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd54aba98f at pc 0x55e02de26837 bp 0x7ffd54ab9fe0 sp 0x7ffd54ab9fd0\r\nREAD of size 1 at 0x7ffd54aba98f thread T0\r\n    #0 0x55e02de26836 in font_driver_reshape_msg gfx/font_driver.c:849\r\n    #1 0x55e02de27a97 in font_driver_render_msg gfx/font_driver.c:932\r\n    #2 0x55e02e62b74f in gl_set_osd_msg gfx/drivers/gl.c:836\r\n    #3 0x55e02dd1360c in video_driver_set_osd_msg gfx/video_driver.c:1179\r\n    #4 0x55e02e3cdda8 in menu_display_draw_text menu/menu_driver.c:1600\r\n    #5 0x55e02e359620 in xmb_draw_text menu/drivers/xmb.c:812\r\n    #6 0x55e02e36ef51 in xmb_draw_item menu/drivers/xmb.c:2756\r\n    #7 0x55e02e371be6 in xmb_draw_items menu/drivers/xmb.c:2917\r\n    #8 0x55e02e382aec in xmb_frame menu/drivers/xmb.c:3869\r\n    #9 0x55e02e3cf987 in menu_driver_frame menu/menu_driver.c:1884\r\n    #10 0x55e02e632726 in gl_frame gfx/drivers/gl.c:1131\r\n    #11 0x55e02dd1d59b in video_driver_frame gfx/video_driver.c:2619\r\n    #12 0x55e02dd14eff in video_driver_cached_frame gfx/video_driver.c:1423\r\n    #13 0x55e02e3b5d62 in menu_display_libretro menu/menu_driver.c:541\r\n    #14 0x55e02e3d01ce in menu_driver_render menu/menu_driver.c:1925\r\n    #15 0x55e02db75b62 in runloop_check_state /home/bp/RetroArch/retroarch.c:2789\r\n    #16 0x55e02db794fc in runloop_iterate /home/bp/RetroArch/retroarch.c:3440\r\n    #17 0x55e02df1ceb7 in ui_application_qt_run ui/drivers/qt/ui_qt_application.cpp:158\r\n    #18 0x55e02db628e9 in rarch_main frontend/frontend.c:157\r\n    #19 0x55e02df1d00a in main ui/drivers/qt/ui_qt_application.cpp:182\r\n    #20 0x7ff0cb4bf222 in __libc_start_main (/usr/lib/libc.so.6+0x24222)\r\n    #21 0x55e02db5283d in _start (/home/bp/RetroArch/retroarch+0x3c5983d)\r\n\r\nAddress 0x7ffd54aba98f is located in stack of thread T0 at offset 287 in frame\r\n    #0 0x55e02e36c1af in xmb_draw_item menu/drivers/xmb.c:2607\r\n\r\n  This frame has 6 object(s):\r\n    [32, 64) 'rotate_draw'\r\n    [96, 136) 'ticker'\r\n    [192, 256) 'mymat_tmp'\r\n    [288, 543) 'tmp' <== Memory access at offset 287 underflows this variable\r\n    [576, 1088) 'entry_sublabel'\r\n    [1120, 5216) 'entry_path'\r\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext\r\n      (longjmp and C++ exceptions *are* supported)\r\nSUMMARY: AddressSanitizer: stack-buffer-overflow gfx/font_driver.c:849 in font_driver_reshape_msg\r\nShadow bytes around the buggy address:\r\n  0x10002a94f4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x10002a94f4f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x10002a94f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1\r\n  0x10002a94f510: f1 f1 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 f2\r\n  0x10002a94f520: f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 f2 f2\r\n=>0x10002a94f530: f2[f2]00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x10002a94f540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x10002a94f550: 00 07 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00\r\n  0x10002a94f560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x10002a94f570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x10002a94f580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n==7514==ABORTING\r\n```\r\n\r\nHappens at least with both xmb and ozone.\r\n\r\n### Expected behavior\r\n\r\nNo stack overflow.\r\n\r\n### Actual behavior\r\n\r\nStack overflow.\r\n\r\n### Steps to reproduce the bug\r\n\r\nIt can be triggered a few different ways:\r\n\r\n(assuming XMB)\r\n\r\n1. Go to Settings -> User -> Language, press right until just after Vietnamese, it crashes\r\n2. Go to Settings -> User -> Language, press left until just after Greek, it crashes\r\n3. Go to Settings -> User -> Language, press enter to show the selection submenu, then press down until just after French, it crashes (seems dependent on the window size... if you resize it to show the entry after Vietnamese (which would be Arabic?), it will crash too)\r\n\r\n### Bisect Results\r\n\r\nIssue is somewhere between 1.7.0 (good) and 1.7.1 (bad), but too many commits had to be skipped during the bisect because they all crashed on startup.\r\n\r\n```\r\nThere are only 'skip'ped commits left to test.\r\nThe first bad commit could be any of:\r\n1f3e1baeb6eec69870121ad3b9c90b7c20e52528\r\n1bfea60c2d56942659c7ae5f69cf3fcdc9f28454\r\nda0e2e6a51abef60f27ca76387129a0c4c532bc3\r\n31b99e2b01f2b7bc4e5b27c4a50bb15772589d49\r\na8af4ee8c618644237cc736e8c927c5a43d0d2d9\r\n01d659a4a3b1f7525128bdf41979466242c54b29\r\n843a7f200cb36b0d9c9960394f9fd895466cbe98\r\n40e9416c6ca44f501afbf22aa4facaa8fa505594\r\nb141c37fe924b2b4b987ed254c86f5ccc1181b87\r\n49bea666ff54ac7e11f984b90e702f0a7e145107\r\nb5d2782833373287565e31aa4b9c6133c59bc223\r\nb45b1b3e55f90758fe1d8a6fbdac202b71bb4a45\r\nbfb71f06946de1825a8005d65b2ff5b46aaa9804\r\n875ab9378dbbcd80f0fa4f838b5ed549c33a7f95\r\nb31779c588fbdc1828be42350491ec7786c1d602\r\n72ff4c4d444ff660be79d77bc3b8f124ab769d15\r\n8b1f8b8ae2b85d680c9734bdba5a3942de2b617f\r\na8ee5f6c44a6253bb4cfd6a8085ef46505cada6e\r\nfebfc18f0b118076cab9678ba0e89da7d623e87c\r\nWe cannot bisect more!\r\n```\r\n\r\n### Version/Commit\r\n- RetroArch: 6c51c445\r\n\r\n### Environment information\r\n\r\n- OS: archlinux x64\r\n- Compiler: gcc 8.2.1\r\n"},"comment":{"url":"https://api.github.com/repos/libretro/RetroArch/issues/comments/449889153","html_url":"https://github.com/libretro/RetroArch/issues/7508#issuecomment-449889153","issue_url":"https://api.github.com/repos/libretro/RetroArch/issues/7508","id":449889153,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0OTg4OTE1Mw==","user":{"login":"orbea","id":4204285,"node_id":"MDQ6VXNlcjQyMDQyODU=","avatar_url":"https://avatars2.githubusercontent.com/u/4204285?v=4","gravatar_id":"","url":"https://api.github.com/users/orbea","html_url":"https://github.com/orbea","followers_url":"https://api.github.com/users/orbea/followers","following_url":"https://api.github.com/users/orbea/following{/other_user}","gists_url":"https://api.github.com/users/orbea/gists{/gist_id}","starred_url":"https://api.github.com/users/orbea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/orbea/subscriptions","organizations_url":"https://api.github.com/users/orbea/orgs","repos_url":"https://api.github.com/users/orbea/repos","events_url":"https://api.github.com/users/orbea/events{/privacy}","received_events_url":"https://api.github.com/users/orbea/received_events","type":"User","site_admin":false},"created_at":"2018-12-26T02:16:58Z","updated_at":"2018-12-26T02:16:58Z","author_association":"COLLABORATOR","body":"This might be related. https://github.com/libretro/RetroArch/issues/7822"}}
{"actor":{"display_login":"orbea"}}