SEGV on unknown address 0x000000000008 (pc 0x55ddeaecf1cb bp 0x7fff8d0be190 sp 0x7fff8d0be120 T0) in dag::Vector<char, eastl::allocator, false, unsigned int>::used()

[julestheshiba]

Description

AddressSanitizer:DEADLYSIGNAL
=================================================================
==2834633==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x55ddeaecf1cb bp 0x7fff8d0be190 sp 0x7fff8d0be120 T0)
==2834633==The signal is caused by a READ memory access.
==2834633==Hint: address points to the zero page.
    #0 0x55ddeaecf1cb in dag::Vector<char, eastl::allocator, false, unsigned int>::used() const /home/william/Documents/develop/DagorEngine/fuzz/../prog/1stPartyLibs/dag/dag_vector.h:925:47
    #1 0x55ddeaecf1cb in dag::Vector<char, eastl::allocator, false, unsigned int>::size() const /home/william/Documents/develop/DagorEngine/fuzz/../prog/1stPartyLibs/dag/dag_vector.h:255:45
    #2 0x55ddeaecf1cb in DataBlock::blocksOffset() const /home/william/Documents/develop/DagorEngine/fuzz/../prog/engine/ioSys/dataBlock/blk_core.cpp:463:21
    #3 0x55ddeaecf1cb in DataBlock::getBlockRW(unsigned int) /home/william/Documents/develop/DagorEngine/fuzz/../prog/engine/ioSys/dataBlock/blk_core.cpp:638:30
    #4 0x55ddeaecf1cb in DataBlock::getBlock(unsigned int) /home/william/Documents/develop/DagorEngine/fuzz/../prog/engine/ioSys/dataBlock/blk_core.cpp:650:71
    #5 0x55ddeaecf1cb in DataBlock::~DataBlock() /home/william/Documents/develop/DagorEngine/fuzz/../prog/engine/ioSys/dataBlock/blk_core.cpp:102:15
    #6 0x55ddeaece197 in main /home/william/Documents/develop/DagorEngine/fuzz/../fuzz/fuzz_blk.cpp:151:5
    #7 0x7feb0bd186c0 in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:59:16
    #8 0x7feb0bd187f8 in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #9 0x55ddead71724 in _start (/home/william/Documents/develop/DagorEngine/fuzz/build/fuzz_blk-asan-dev+0x6b724) (BuildId: ca0d05b3b52a81b1b4947922d8048a5598322e53)

==2834633==Register values:
rax = 0x0000000000000008  rbx = 0x00007beb09df0020  rcx = 0x0000000000000000  rdx = 0x00000f7d613be007  
rdi = 0x0000000000000000  rsi = 0x0000000000000000  rbp = 0x00007fff8d0be190  rsp = 0x00007fff8d0be120  
 r8 = 0x000000000000ffff   r9 = 0x00000000ffffffff  r10 = 0x0000000000000000  r11 = 0x0000000000000000  
r12 = 0x00000f7d613be004  r13 = 0x00000000ffffffff  r14 = 0x000000000000001e  r15 = 0x0000000000000000  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/william/Documents/develop/DagorEngine/fuzz/../prog/1stPartyLibs/dag/dag_vector.h:925:47 in dag::Vector<char, eastl::allocator, false, unsigned int>::used() const
==2834633==ABORTING

How to Reproduce

See attached input file

crash.zip

This was done as part of a fuzzing campaign at the University of Utah. This was done using a harness as seen https://github.com/julestheshiba/Dagor-Engine-Fuzzing/blob/main/fuzz/fuzz_blk.cpp.

Environement

• Linux 6.18.22-1-lts
• System Architecture: x86-64
• Dagor Engine Version: https://github.com/GaijinEntertainment/DagorEngine/commit/210be6a3fccc86f467d8eb09941a54200befc562
• Installation method: built from source
• Compiler: afl-clang-fast++