[Scummvm-tracker] [ScummVM :: Bugs] #17016: NANCY: Heap overread looking at Ace & Clyde

[ScummVM :: Bugs]

#17016: NANCY: Heap overread looking at Ace & Clyde
-------------------------------------------------+-------------------------
Reporter:  tunnelsociety                         |      Owner:  (none)
    Type:  defect                                |     Status:  new
Priority:  high                                  |  Component:  Engine:
                                                 |  Nancy
 Version:                                        |   Keywords:
    Game:  Nancy Drew: The Secret of Shadow      |
  Ranch                                          |
-------------------------------------------------+-------------------------
 A heap overread is reported by ASan when Nancy greets the other horses.

 ScummVM 2026.3.1git9148-g36f45f67418

 I reproduce as far back as c578867ebd41ca178d7d529ee5a1bdf24b5d0b47 so I
 don't think this issue was recently introduced. (That's "recently" in
 terms of nancy10 history! ;) )

 {{{
 Loading new scene 4418: description "COR ", frame 0, vertical scroll 0,
 kContinueSceneSound
 =================================================================
 ==18840==ERROR: AddressSanitizer: heap-buffer-overflow on address
 0x52500007f644 at pc 0x5592dfd0d585 bp 0x7fff56204af0 sp 0x7fff56204ae8
 READ of size 2 at 0x52500007f644 thread T0
     #0 0x5592dfd0d584 in
 Graphics::ManagedSurface::blitFromInner(Graphics::Surface const&,
 Common::Rect const&, Common::Rect const&, Graphics::Palette const*)
 graphics/managed_surface.cpp:655:11
     #1 0x5592dfd1018e in
 Graphics::ManagedSurface::blitFrom(Graphics::ManagedSurface const&,
 Common::Rect const&, Common::Rect const&)
 graphics/managed_surface.cpp:579:3
     #2 0x5592de5600b1 in
 Nancy::GraphicsManager::blitToScreen(Nancy::RenderObject const&,
 Common::Rect) engines/nancy/graphics.cpp:445:10
     #3 0x5592de55fa9d in Nancy::GraphicsManager::draw(bool)
 engines/nancy/graphics.cpp:155:5
     #4 0x5592dee4bd24 in Nancy::NancyEngine::run()
 engines/nancy/nancy.cpp:389:14
     #5 0x5592de4ba697 in runGame(Plugin const*, OSystem&, DetectedGame
 const&, void const*) base/main.cpp:328:33
     #6 0x5592de4afd9b in scummvm_main base/main.cpp:840:13
     #7 0x5592de4a2206 in main backends/platform/sdl/posix/posix-
 main.cpp:56:12
     #8 0x7f74ecc35ca7  (/lib/x86_64-linux-gnu/libc.so.6+0x29ca7) (BuildId:
 c495b62edadd6c356265942ec1282d98058a7b41)
     #9 0x7f74ecc35d64 in __libc_start_main (/lib/x86_64-linux-
 gnu/libc.so.6+0x29d64) (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)
     #10 0x5592de395210 in _start (scummvm+0x1b7a210) (BuildId:
 aa77fb462a590a1861f2dd86c1578686cc1e06e4)

 0x52500007f644 is located 0 bytes after 9540-byte region
 [0x52500007d100,0x52500007f644)
 allocated by thread T0 here:
     #0 0x5592de43522d in calloc (scummvm+0x1c1a22d) (BuildId:
 aa77fb462a590a1861f2dd86c1578686cc1e06e4)
     #1 0x5592dfe2783b in Graphics::Surface::create(short, short,
 Graphics::PixelFormat const&) graphics/surface.cpp:156:12
     #2 0x5592dfcfacd6 in Graphics::ManagedSurface::create(short, short,
 Graphics::PixelFormat const&) graphics/managed_surface.cpp:165:16
     #3 0x5592de562966 in
 Nancy::GraphicsManager::copyToManaged(Graphics::Surface const&,
 Graphics::ManagedSurface&, bool, bool) engines/nancy/graphics.cpp:240:7
     #4 0x5592de7c4dcf in Nancy::Action::PlaySecondaryMovie::execute()
 engines/nancy/action/secondarymovie.cpp:752:4
     #5 0x5592de7571e3 in
 Nancy::Action::ActionManager::processActionRecords()
 engines/nancy/action/actionmanager.cpp:260:12
     #6 0x5592de5a0d5e in Nancy::State::Scene::run()
 engines/nancy/state/scene.cpp:1291:17
     #7 0x5592de596cf7 in Nancy::State::Scene::process()
 engines/nancy/state/scene.cpp:177:3
     #8 0x5592dee4bb62 in Nancy::NancyEngine::run()
 engines/nancy/nancy.cpp:384:7
     #9 0x5592de4ba697 in runGame(Plugin const*, OSystem&, DetectedGame
 const&, void const*) base/main.cpp:328:33
     #10 0x5592de4afd9b in scummvm_main base/main.cpp:840:13
     #11 0x5592de4a2206 in main backends/platform/sdl/posix/posix-
 main.cpp:56:12
     #12 0x7f74ecc35ca7  (/lib/x86_64-linux-gnu/libc.so.6+0x29ca7)
 (BuildId: c495b62edadd6c356265942ec1282d98058a7b41)

 SUMMARY: AddressSanitizer: heap-buffer-overflow
 graphics/managed_surface.cpp:655:11 in
 Graphics::ManagedSurface::blitFromInner(Graphics::Surface const&,
 Common::Rect const&, Common::Rect const&, Graphics::Palette const*)
 Shadow bytes around the buggy address:
   0x52500007f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x52500007f400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x52500007f480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x52500007f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x52500007f580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 =>0x52500007f600: 00 00 00 00 00 00 00 00[04]fa fa fa fa fa fa fa
   0x52500007f680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x52500007f700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x52500007f780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x52500007f800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
   0x52500007f880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:           00
   Partially addressable: 01 02 03 04 05 06 07
   Heap left redzone:       fa
   Freed heap region:       fd
   Stack left redzone:      f1
   Stack mid redzone:       f2
   Stack right redzone:     f3
   Stack after return:      f5
   Stack use after scope:   f8
   Global redzone:          f9
   Global init order:       f6
   Poisoned by user:        f7
   Container overflow:      fc
   Array cookie:            ac
   Intra object redzone:    bb
   ASan internal:           fe
   Left alloca redzone:     ca
   Right alloca redzone:    cb
 ==18840==ABORTING
 }}}
-- 
Ticket URL: <https://bugs.scummvm.org/ticket/17016>
ScummVM :: Bugs <https://bugs.scummvm.org>
ScummVM