x

Search in
Sort by:

Question Status:

Search help

  • Simple searches use one or more words. Separate the words with spaces (cat dog) to search cat,dog or both. Separate the words with plus signs (cat +dog) to search for items that may contain cat but must contain dog.
  • You can further refine your search on the search results page, where you can search by keywords, author, topic. These can be combined with each other. Examples
    • cat dog --matches anything with cat,dog or both
    • cat +dog --searches for cat +dog where dog is a mandatory term
    • cat -dog -- searches for cat excluding any result containing dog
    • [cats] —will restrict your search to results with topic named "cats"
    • [cats] [dogs] —will restrict your search to results with both topics, "cats", and "dogs"

TInlineAllocator can corrupt memory

Hello,

TInlineAllocator can corrupt memory when calling void ResizeAllocation(int32 PreviousNumElements,int32 NumElements,SIZE_T NumBytesPerElement).

If allocation is done in dynamic buffer and PreviousNumElements > NumInlineElements the RelocateConstructItems will corrupt memory, it will move PreviousNumElements instead of max NumInlineElements elements

Product Version: UE 4.18
Tags:
more ▼

asked Oct 31 '17 at 06:11 PM in Bug Reports

avatar image

Astraya
1 1 1

avatar image Matthew J Nov 02 '17 at 06:23 PM

Hello Astraya,

Is this a regression from a previous version? Also, can you provide a reproduction case of some sort? A list of steps or a project that reproduces the issue would be helpful.

avatar image Astraya Nov 02 '17 at 08:09 PM

Hello Matthew,

This is not a regression, this code exist this 324683c on 14 Mar 2014. To reproduce the corruption just use TInlineAllocator with for exemple NumInlineElements == 8 and call ResizeAllocation(0, 16, 4), this will allocate the dynamic buffer. Then call ResizeAllocation(16, 8, 4), this will try to reallocate 16 item in a static buffer of 8 items (Using Memmove or placement new depending of the ElementType). Buffer overflow possibly appears here.

The fix is simple:

Do not call RelocateItems((void*)InlineData, (ElementType*)SecondaryData.GetAllocation(), PreviousNumElements); but RelocateItems((void*)InlineData, (ElementType*)SecondaryData.GetAllocation(), NumInlineElements);. Here we only want to move memory of maximum NumInlineElements.

(comments are locked)
10|2000 characters needed characters left
Viewable by all users

2 answers: sort voted first

If you know what changes should be made to fix the issue, I would suggest making a pull request on Github. This way, you can submit your proposed change and the developers can take a look at it. They'll respond to you once they've reviewed it either with questions or to let you know that it is being accepted. You can follow this guide if you do not know how to submit a Github pull request: https://wiki.unrealengine.com/Git_Pull_Requests

more ▼

answered Nov 03 '17 at 08:00 PM

(comments are locked)
10|2000 characters needed characters left
Viewable by all users

I'd go one step further and call this a non-issue.

As far as I understand the engine code, it's wrong to call ResizeAllocation() with PreviousNumElements > NumElements. The only thing that might be missing there would be an assertion that tells the user that invalid parameters were supplied.

Also, as PreviousNumElements is in all cases smaller than NumElements, calling RelocateItems with NumInlineElements as last parameter instead of PreviousNumElements will lead to issues, as in case bitwise relocation is not possible the destructor of the stored type might be called multiple times (or on otherwise invalid data).

more ▼

answered Jul 27 '18 at 03:29 PM

avatar image

soulsource_ag
237 5 13 15

(comments are locked)
10|2000 characters needed characters left
Viewable by all users
Your answer
toggle preview:

Up to 5 attachments (including images) can be used with a maximum of 5.2 MB each and 5.2 MB total.

Follow this question

Once you sign in you will be able to subscribe for any updates here

Answers to this question